North Korean-linked hackers likely walked away with roughly $280 million in stolen USDC — and now a Massachusetts federal court must decide whether stablecoin issuer Circle Internet Financial should have done more to stop the flow.
What happened
- On April 1, attackers drained funds from the Solana-based Drift Protocol and used Circle’s Cross-Chain Transfer Protocol (CCTP) — the company’s bridging tool — to move the loot from Solana to Ethereum. Reports say the transfers unfolded over several hours during regular U.S. business hours, creating a long window for intervention.
- After reaching Ethereum, the stolen USDC was converted and pushed through Tornado Cash, a privacy-mixing protocol used to obscure transaction trails.
- Crypto analytics firm Elliptic identified the operation as likely the work of North Korean state-backed actors and flagged more than 100 transactions that traversed Circle’s bridging infrastructure.
The lawsuit
- A class-action complaint filed this week in U.S. District Court in Massachusetts names Circle as the defendant. Plaintiff Joshua McCollum, a Drift Protocol investor, represents more than 100 affected members.
- The suit alleges Circle “had both the means and the opportunity” to stop about $280 million in stolen USDC from moving across chains but failed to act. Plaintiffs’ counsel, Mira Gibb, has charged Circle with negligence and aiding and abetting conversion — a legal claim for helping someone unlawfully take another’s property.
- Damages have not been set and will be determined at trial. Circle did not respond to requests for comment.
A crucial detail and the legal question
- Plaintiffs highlight a striking detail: roughly a week before the Drift exploit, Circle froze 16 USDC wallets tied to a sealed U.S. civil case. Their argument is straightforward: if Circle could act quickly to freeze wallets related to a court matter, it should have been able to act similarly when it appears criminal actors were exploiting its infrastructure.
- That contrast sits at the heart of the dispute: is Circle a de facto gatekeeper with responsibility to block illicit flows, or is it constrained from freezing funds absent a court order or other legal compulsion?
Industry reactions
- The case is drawing sharp debate. Some, including blockchain analyst James Seyffart, have called for clarity and precedent — arguing platforms either must be able to freeze illicit funds or they should admit they lack that power.
- Others caution against giving private companies broad unilateral freezing authority. Lorenzo Valente, director of digital asset research at ARK Invest, defended Circle’s hesitance to act without a court order, warning that permitting judgment-based freezes could politicize custody decisions and blur lines between suspicious activity and outright criminality.
Why it matters
- Beyond the immediate dispute over $280 million, the lawsuit probes a foundational tension in crypto policy: the role of centralized stablecoin issuers and bridge operators in policing on-chain activity. A court ruling could set an influential precedent over whether firms like Circle owe a legal duty to stop illicit transfers in real time — and, if so, what standards govern those stops.
Image credit: B&G Lawyers. Chart: TradingView.
Read more AI-generated news on: undefined/news
