Circle Faces Class Action Over Alleged Failure to Freeze $230M in USDC After Drift Exploit

A proposed class-action lawsuit filed in Massachusetts is forcing one of the most consequential legal questions in stablecoin history: does a payment stablecoin issuer bear legal responsibility when it declines to freeze stolen funds it demonstrably had the power to stop? The complaint, targeting Circle Internet Financial, centers on $230 million in USDC that moved across chains following the April 1, 2026 Drift Protocol breach, allegedly without any freeze action from Circle despite the transfers occurring during ordinary U.S. business hours. [1][2]

The Legal Claim

The lead plaintiff, Joshua McCollum, represents a proposed class of more than 100 users who suffered losses in the Drift incident. The complaint argues two things simultaneously: that Circle possessed the technical infrastructure to freeze the implicated USDC addresses in real time, and that Circle's own terms of service and compliance framework granted it the contractual authority to do so. Together, those two assertions form a negligence theory that legal observers are calling a direct challenge to how centralized stablecoin issuers have historically defined their role during DeFi crises. [2]

The timeline matters to the plaintiffs' argument. After the initial breach, the attackers split stolen USDC across more than 100 transactions, bridging funds from Solana to Ethereum over a window of approximately eight hours. That extended movement window, the complaint contends, gave Circle ample opportunity to intervene. The funds were later routed through mixing infrastructure to obscure their trail, a step that became possible only after the multi-hour bridging process went uninterrupted. [2]

Circle's Position

Circle has not yet issued a formal response to the lawsuit itself, but senior leadership has articulated a clear policy position in the days since the filing. Jeremy Allaire and Dante Disparte have both stated publicly that Circle freezes USDC exclusively when it receives formal orders or directives from law enforcement agencies.

"Discretionary or real-time freezes during hacks, taken without legal authorization, could create significant legal and governance risks for the USDC ecosystem." - Circle leadership, per public statements following the Drift incident [2]

Their position holds that unilateral intervention could overstep regulatory boundaries and undermine the predictability that USDC users depend on. The company has simultaneously used the controversy to advocate for federal legislative clarity, pointing to both the GENIUS Act and the CLARITY Act as frameworks that, if enacted, would define precisely what obligations payment stablecoin issuers carry during security incidents. [2]

A Pattern Under Scrutiny

The Massachusetts filing does not arrive in isolation. On-chain investigator ZachXBT published a report, widely referenced in crypto legal circles as the "Circle Files," documenting at least 15 incidents since 2022 in which Circle allegedly delayed or declined to freeze USDC associated with illicit activity. The report identifies more than $420 million in funds across those incidents. [2]

The comparison that has attracted the most attention involves the February 2025 Bybit hack. In that incident, Tether froze assets linked to the exploit within hours. Circle, according to the same account, took approximately 24 hours to act. Similar delay patterns were reported in connection with the Radiant Capital exploit, the Mango Markets case, and the Nomad Bridge incident. For plaintiffs' counsel, that history of inconsistent freeze timing is potentially as important as the Drift facts themselves: it suggests discretion was exercised, which in turn implies a duty could attach. [2]

Stablecoin Freeze Precedents

The Tornado Cash precedent is particularly pointed. In August 2022, Circle froze USDC held in addresses sanctioned by the Office of Foreign Assets Control following that agency's designation of the mixing protocol. The plaintiffs are likely to argue that Circle's willingness to act on an OFAC designation, but not on a real-time multi-chain theft in progress, reveals that the constraint was not technical capability but organizational policy. [1][2]

GENIUS Act Implications

The case lands at a critical legislative moment. The GENIUS Act, which would establish a federal licensing and oversight regime for what it terms "permitted payment stablecoin issuers" (PPSIs), is advancing through Congress with Circle's active participation in the policy process. The act in its current form does not explicitly address a PPSI's real-time freeze obligations during security incidents, and the lawsuit is effectively stress-testing that gap before any rule is written. [2]

Legal analysts note that the outcome will likely influence how GENIUS Act regulators draft the operational standards that PPSIs must meet. If the class action produces a judgment or settlement finding that Circle had a duty to act faster, that result will carry significant weight in rulemaking proceedings. Conversely, a dismissal on the grounds that no legal obligation to freeze existed would give issuers a precedent to cite in resisting mandatory real-time intervention requirements. [2]

The Structural Tension

Underlying the lawsuit is a structural tension that the crypto industry has long deferred: the more aggressively a stablecoin issuer exercises its freeze capabilities, the more it resembles a traditional financial intermediary subject to fiduciary obligations, and the less it resembles the neutral infrastructure that DeFi protocols depend on. Circle's leadership has consistently emphasized that USDC's credibility rests partly on the predictability of its freeze policy, meaning freeze actions tied to formal legal process rather than ad hoc crisis judgment. [2]

The plaintiffs' theory inverts that logic. By arguing that capability plus opportunity equals duty, the complaint asks a federal court to treat Circle's demonstrated power to act as itself creating a legal obligation to exercise it. How the court addresses that question will shape the legal architecture of stablecoin issuance for years beyond the Drift incident itself. [1][2]

References

[1] Coinpedia, "Circle Sued for Failing to Freeze $230M in USDC After Drift Hack," April 17, 2026. https://coinpedia.org/crypto-live-news/circle-sued-for-failing-to-freeze-230m-in-usdc-after-drift-hack/amp/

[2] OurCryptoTalk, "Circle Faces Class-Action Over $230M USDC Loss in Drift Hack," April 17, 2026. https://ourcryptotalk.com/news/circle-usdc-lawsuit-drift-hack-230m