Circle Internet Group faces a class‑action lawsuit alleging it failed to freeze $280‑$295 million in stolen USDC after a Drift Protocol hack. [1][2]

The case matters because it tests how stable‑coin issuers respond to large‑scale breaches and could shape regulatory expectations for real‑time asset controls. [6]

On April 1, 2024, attackers exploited a vulnerability in the Drift Protocol, moving roughly $280 million to $295 million worth of USDC out of the platform. [1][2] The loss, described as one of the biggest crypto heists of the year, spurred immediate concern among investors who rely on Circle’s stablecoin for liquidity.

A group of Drift investors, led by Joshua McCollum, filed the complaint in U.S. District Court for the District of Massachusetts on a Wednesday in April 2024. [5] The filing alleges Circle had an eight‑hour window to freeze the stolen tokens but did not act, allowing the funds to be transferred further. [6]

The plaintiffs list includes over 100 members who claim they suffered financial harm because the USDC remained movable. [3] They argue Circle’s failure to intervene breached its duty to protect token holders and seek restitution for the full amount of the hack.

Circle has not issued a public comment on the lawsuit, and its legal team declined to respond to requests for comment. [5] The company’s standard policy is to cooperate with law‑enforcement investigations while defending its actions in court.

If the plaintiffs prevail, the ruling could compel stable‑coin issuers to implement faster freeze mechanisms and increase oversight of custodial practices. [6] The broader crypto market is watching closely, as any precedent may affect confidence in USDC and similar assets used by institutions worldwide.

**What this means**

A successful suit would set a legal benchmark for the responsibilities of stable‑coin issuers during cyber‑attacks, potentially prompting tighter operational controls and influencing future regulatory frameworks governing digital assets.

“Plaintiffs say Circle had an eight‑hour window to freeze the stolen USDC.”

A court ruling in favor of the plaintiffs would establish that stable‑coin issuers like Circle may be legally required to act swiftly to immobilize compromised tokens, raising the operational bar for digital‑asset custodians and likely prompting tighter regulatory scrutiny of the crypto‑stablecoin ecosystem.