Circle sued for letting $230M in stolen USDC cross its own bridge – days after freezing other wallets

🕑 4 min read

Circle can freeze any USDC wallet on Earth in seconds. It proved that on March 23 when it blacklisted 16 Ethereum addresses in a single batch – for a civil case.

Nine days later, hackers linked to North Korea drained $285M from Drift Protocol and spent 6 hours funneling $230M in stolen USDC through Circle’s own cross-chain bridge. Circle didn’t move.

Now they’re suing.

Key takeaways

• Circle faces a class action after $230M in stolen USDC moved through its CCTP bridge in 100+ transactions over 6 hours – during U.S. business hours – with no freeze.
• Nine days before the hack, Circle froze 16 unrelated wallets for a civil case, proving both the capability and willingness to intervene.
• Tether committed $127.5M to bail out Drift and replace USDC with USDT as the protocol’s settlement layer – a direct strike on Circle’s Solana dominance.

$230M in stolen USDC crossed Circle’s bridge – nobody stopped it

Gibbs Mura, a securities class action firm, filed the complaint in the U.S. District Court for the District of Massachusetts on behalf of named plaintiff Joshua McCollum and more than 100 Drift investors who lost funds in the April 1 exploit. Two causes of action: negligence and aiding and abetting conversion.

The timeline is damning. Attackers used socially engineered admin keys – obtained through Solana’s durable nonce feature, which lets pre-signed transactions stay valid indefinitely – to seize Drift’s smart contracts on April 1. They drained $285M in roughly 12 minutes.

Within 23 minutes, stolen tokens were being swapped to USDC and bridged to Ethereum via Circle’s Cross-Chain Transfer Protocol, a system that burns USDC on one chain and mints it fresh on another.

CCTP isn’t a passive pipe. Every transfer gets validated by Circle through an attestation step. That’s the detail plaintiffs want a jury to hear.

Over the next 6 hours, the attacker ran 100+ bridge transactions. All during U.S. business hours. Some moved millions at a clip.

Circle validated every one. Once on Ethereum, the funds vanished into Tornado Cash.

Picture a bank lobby guard watching someone haul duffel bags of cash past his desk for half a workday. That’s roughly what happened – except the guard also stamped each bag on the way out.

Frozen for a civil case, silent for a $285M hack

On March 23, Circle blacklisted 16 Ethereum addresses connected to a sealed U.S. civil lawsuit – a batch freeze that swept up exchanges, casinos, forex platforms, and even the ckETH Minter contract operated by the DFINITY Foundation, a public bridge that thousands of uninvolved users relied on.

ZachXBT, the on-chain investigator who’s documented over $420M in Circle freeze failures since 2022, called the March 23 action “incompetent.” Several frozen wallets handled clearly legitimate business. Circle walked back part of it, unfreezing 5 of 16 addresses after backlash.

But the precedent was set.

“Circle has a very, very clear performance obligation under the law. We are able to undertake actions such as freezing a wallet at the direction of law enforcement or the courts,” CEO Jeremy Allaire said in a public statement following the Drift incident.

So why freeze casino hot wallets for a civil dispute but not $230M in obviously stolen funds flowing through your own infrastructure? Former federal prosecutor Amanda Wick put it bluntly: Circle had both the technical and legal authority to act. It chose not to.

Tether swoops in with $127.5M – and claims Circle’s Solana throne

While Circle played defense, Tether played offense.

On April 16 – one day before the lawsuit went public – Tether committed $127.5M (with $20M from partners) to bail out Drift Protocol. The catch: Drift relaunches with USDT as its core settlement layer, replacing USDC entirely. All 128,000+ users and 35+ ecosystem teams migrate. DRIFT jumped 20% on the news.

The freeze track records aren’t even close. Tether has blacklisted 7,268 addresses and frozen roughly $3.29B in illicit funds.

Circle? Just 372 addresses and $109M. For a $78.7B stablecoin that markets itself on compliance and transparency, that 30x gap stings.

And this isn’t Circle’s first lapse. ZachXBT’s documentation covers the $223M Cetus DEX exploit and the $16M Swapnet hack – cases where delayed or absent freezes let stolen funds vanish before anyone could recover them.

Circle’s stock (CRCL) tells the story. After debuting at $31 and surging to $298.99, shares have cratered 64% to $107.46. Q1 earnings drop May 11 – and the lawsuit will dominate the call.

What to watch

• Whether Circle’s “we only act with a court order” defense survives the March 23 evidence – those 16 wallets were frozen for a civil matter, not a criminal one.
• The GENIUS Act and CLARITY Act, legislation aimed at codifying stablecoin freeze obligations, could set the standard. But New York prosecutors warn the current draft may actually shield issuers from returning stolen assets.
• USDC still holds $8.1B on Solana versus USDT’s $3.05B. If Drift’s switch triggers a broader migration, Circle loses its strongest DeFi bridgehead.

For a deeper look at how USDT and USDC compare on freezes, reserves, and audit trails, see our stablecoin safety guide.

Circle says it follows the rule of law. Tether says it follows the money. A Massachusetts courtroom will decide which standard a $78.7B stablecoin issuer actually owes its users.

This is not financial advice. DYOR. Data as of April 17, 2026.

Sources: Gibbs Mura filing, CoinDesk, Elliptic, TRM Labs, Cointelegraph, CoinGecko API