North Korean hackers likely pocketed hundreds of millions in stolen crypto — and now a US court is being asked to decide whether a stablecoin giant should have stopped them. Circle’s Own Track Record Becomes A Key Weapon A class action lawsuit filed in a Massachusetts federal court this week names Circle Internet Group as the defendant, with plaintiffs arguing the company had both the means and the opportunity to stop roughly $280 million in stolen USDC from moving across blockchains — and did nothing. The case was brought by Drift Protocol investor Joshua McCollum, representing more than 100 affected members. Their attorneys put it plainly: Circle allowed criminal use of its own technology. The April 1 attack on Drift Protocol saw attackers drain funds and route them from Solana to Ethereum using Circle’s Cross-Chain Transfer Protocol, a bridging tool the company operates. The transfers happened over several hours, according to reports. The window was wide open. What makes the lawsuit particularly pointed is what happened just days before the hack. About a week prior, Circle froze 16 USDC wallets tied to a sealed US civil case. Plaintiffs seized on that detail. If Circle could move fast for a court-adjacent matter, they argue, it could have acted here too. That single fact sits at the center of the legal fight. I hope there’s some precedent set. Either you’re a decentralized protocol and literally do not have the power to freeze or you’re not and you should be freezing hacked funds. This middle ground hand wavy “only with a court order” stuff is weak. Misses the forest for the trees https://t.co/TqzOYKZOvm — James Seyffart (@JSeyff) April 16, 2026 Accusations Range From Negligence To Aiding The Crime The suit carries two main charges: negligence and aiding and abetting conversion — a legal term for helping someone unlawfully take another person’s property. The law firm Mira Gibb is handling the case for McCollum and the other Drift investors. Damages have not yet been set and will be determined at trial. Circle has not responded to requests for comment. Crypto analytics firm Elliptic flagged the attack as the work of North Korean state-backed operatives. Based on Elliptic’s analysis, the hackers executed more than 100 transactions through Circle’s bridging infrastructure during regular US business hours. After moving the funds to Ethereum, the stolen assets were converted and pushed through Tornado Cash, a privacy protocol used to obscure transaction trails. ARK Invest Defends Circle, But The Moral Stakes Remain High Not everyone is pointing fingers at Circle. Lorenzo Valente, ARK Invest’s director of digital asset research, argued that Circle made the right call by not acting without a legal order. His concern: give a company like Circle the power to freeze funds on judgment alone, and every decision becomes political. He questioned aloud where the line would be drawn — between a North Korean hacker and a suspicious wallet elsewhere in the world. Featured image from B&G Lawyers, chart from TradingView
