April 1 hack drained ~$280–285M from Solana-based Drift; attackers moved funds to Ethereum over ~8 hours via Circle's CCTP/Cross-Chain transfer, with plaintiffs saying up to $230M was offloaded. Drift TVL plunged from ~ $550M to under $250M; deposits/withdrawals suspended and at least 20 other DeFi protocols reported indirect losses, signaling systemic contagion risk in DeFi and crypto markets. Massachusetts class-action alleges Circle/USDC had contractual and technical ability to freeze stolen assets (it froze 16 unrelated wallets nine days earlier) but failed to act, creating legal and security risk for cross-chain token flows.

Bearish

Predictions Markets

See what traders are focused on

View analytics →

Circle (CRCL), the issuer behind the USDC stablecoin, is facing a fresh lawsuit in Massachusetts tied to the $280 million Drift Protocol hack that occurred on April 1.

The complaint, filed by plaintiffs represented by the law firm Gibbs Mura, alleges that Circle did not take action to freeze stolen funds even though it had both the technical ability and contractual authority to do so.

Drift Hack Fallout

According to the lawsuit, attackers drained an estimated $280–$285 million from the Solana-based exchange in less than 12 minutes. The stolen assets were then moved from Solana to Ethereum over the course of roughly eight hours using Circle’s Cross-Chain Transfer Protocol (CCTP).

The transfer allegedly took place during US business hours, a detail plaintiffs highlight to emphasize that the alleged movement and conversion of funds occurred while the matter was ongoing, without intervention from Circle to freeze the assets.

The filing further claims that user funds were pulled from multiple parts of Drift’s platform, including trading, lending, and vault deposits. As the breach unfolded, Drift’s total value locked reportedly fell sharply from about $550 million to under $250 million.

In response to the incident, deposits and withdrawals were suspended indefinitely. The impact, plaintiffs say, extended beyond Drift itself: at least 20 other DeFi protocols reported indirect losses related to exposure to Drift.

Circle Accused Of Not Freezing Assets

The plaintiffs also point to a separate earlier civil matter involving Circle. Nine days before the Drift-related lawsuit, Circle reportedly froze 16 unrelated business wallets.

That, according to the plaintiffs, demonstrates that Circle has the capability—and, in that instance, the willingness—to freeze funds when it deems it appropriate.

However, the lawsuit alleges that Circle failed to freeze the stolen USDC and other assets that were allegedly converted into USDC after the hack.

Circle is accused of using its Cross-Chain Transfer Protocol in a way that plaintiffs say allowed attackers to offload up to $230 million onto the Ethereum blockchain.

In the lawsuit’s framing, this is central to why the plaintiffs believe Circle should have acted to prevent the transfers of stolen stablecoins and connected assets during the time the funds were being moved.