Circle Hit With Lawsuit Over $230M USDC Hack Freeze Claim

Circle is facing a proposed class action after investors in Drift Protocol alleged the stablecoin issuer failed to freeze roughly $230 million in stolen USDC during the April 1, 2026 exploit, even though the funds allegedly moved through Circle’s own bridge for hours. The complaint, filed in federal court in Massachusetts on April 14, does not just revisit a hack headline. It goes straight at a bigger question for crypto markets: when a centralized stablecoin issuer can freeze funds, when does inaction become liability?

Complaint Targets an Eight-Hour Window After the April 1 Exploit

The filing is specific. Very specific. According to the class action complaint filed as Case 1:26-cv-11733 on April 14, 2026, attackers drained approximately $280 million from Drift Protocol on April 1, 2026, and then used Circle’s infrastructure to move a large share of the proceeds. The complaint states the exploit began at about 11:15 a.m. EDT on April 1, which is 15:15 UTC, and alleges Circle then had an approximately eight-hour period in which it could have intervened before the stolen assets were converted into harder-to-freeze crypto assets.

That timing matters because the plaintiffs are not arguing that Circle caused the hack. They are arguing that Circle allegedly enabled the escape route. The complaint says attackers moved around $230 million through Circle’s USDC and Cross-Chain Transfer Protocol, or CCTP, before swapping into Ether across more than 100 Ethereum wallets. By the plaintiffs’ telling, that made the funds effectively unreachable by the time law enforcement or victims could react through normal channels.

Public reporting broadly matches the core figures. CCN reported on April 17, 2026 that investor Joshua McCollum filed the suit in Massachusetts on behalf of more than 100 affected users, while Investing.com separately reported that the complaint centers on Circle’s alleged failure to freeze about $230 million in USDC after a roughly $280 million Drift exploit on April 1, 2026. Those two reports align with the court filing on the headline numbers and legal theory, which is important because early crypto litigation coverage often drifts on basic facts. Here, the central figures are consistent across sources.

Why the Freeze Argument Is More Serious Than a Standard Post-Hack Blame Game

Here is the angle many quick reports miss: the lawsuit is really about operational asymmetry. Circle is being sued not because USDC is decentralized, but because it is not. The complaint points to Circle’s own contractual and technical powers, including language that Circle “may suspend accounts in its sole and absolute discretion,” and cites a March 23, 2026 incident in which Circle froze USDC held in 16 wallets tied to a sealed civil lawsuit. That was nine days before the Drift exploit.

That comparison is the heart of the case. If Circle could freeze 16 wallets on March 23, 2026, plaintiffs argue, why was no comparable intervention made during the April 1, 2026 Drift incident while stolen USDC allegedly crossed chains in plain sight? The complaint says at least one of those 16 wallets was later unfrozen, which plaintiffs use to argue that Circle’s controls are not theoretical. They are active, discretionary, and already deployed in other contexts.

I have covered enough exploit cases to know where this gets messy. Freezing funds sounds simple until an issuer has to decide, in real time, whether a wallet is definitively tied to theft, whether a freeze order exists, and whether acting without process creates a different legal problem. The Block reported that Circle CEO Jeremy Allaire said acting outside established legal processes in private matters can create a “significant moral quandary.” That does not resolve the lawsuit, but it does frame Circle’s likely defense: capability is not the same thing as obligation.

Circle’s Prior Freeze Record Cuts Both Ways

This is where the case gets uncomfortable for the industry. The complaint and subsequent reporting lean on a broader pattern of alleged compliance failures. CCN cited on-chain investigator ZachXBT’s claim that Circle failed to freeze roughly $420 million in illicit USDC activity since 2022. The examples referenced include a $9 million GMX-related theft in July 2025 and delayed action after the roughly $200 million Cetus exploit in May 2025. Cointelegraph separately reported two weeks ago that ZachXBT alleged Circle failed to freeze $232 million tied to the Drift incident despite a six-hour window and more than 100 transactions.

But that same history also gives Circle a defense. A freeze function is a blunt instrument. Use it too aggressively and the issuer gets accused of arbitrary censorship or wrongful seizure. Cointelegraph reported three weeks ago that ZachXBT also criticized Circle for freezing 16 “unrelated” wallets in another civil case. In other words, Circle is being criticized from both directions: too passive in hacks, too aggressive in civil disputes. That contradiction is not trivial. It goes to the policy vacuum around centralized stablecoins.

Can Circle Defend Inaction if USDC’s Selling Point Is Control?

That is the forward question, and it is bigger than one lawsuit. USDC has long been marketed as the regulated, institution-friendly stablecoin. That positioning helps with adoption, but it also raises expectations. If users believe the issuer can freeze stolen funds, they may assume it should. The Drift complaint tries to convert that expectation into a legal claim.

Data Verification: The key figures were cross-checked across the April 14, 2026 complaint, CCN’s April 17, 2026 report, and Investing.com’s April 17, 2026 report. All three sources point to an exploit of about $280 million, with about $230 million in USDC allegedly moving through Circle-linked rails before conversion. Variance on the core numbers is minimal.

My read is simple. The unique issue is not whether Circle had a freeze button. It is whether the slower bridge-and-convert phase created a practical intervention window after the initial 12-minute theft. Plaintiffs say yes. Circle will likely argue that real-time certainty, legal authority, and operational fairness are not so clean. Either way, this case lands at the fault line of crypto’s hybrid model: centralized control wrapped around supposedly permissionless rails.