On Tuesday, May 12, 2026, seven plaintiffs filed an amended class action complaint in the US District Court for the District of Massachusetts against Circle Internet Group, Inc., a Delaware Corporation, and Circle Internet Financial, LLC. The lawsuit stems from a massive $280 million cryptocurrency exploit of the Drift Protocol, which occurred on April 1, 2026.

The attack, believed to be perpetrated by actors linked to North Korea, saw unidentified assailants drain hundreds of millions in cryptocurrency from the Drift Protocol on the Solana blockchain in a mere 12 minutes. The exploit was reportedly carried out using pre-signed transactions that were obtained through social engineering tactics.

During the exploit, attackers utilized Circle’s own USDC stablecoin and its Cross-Chain Transfer Protocol (CCTP) bridge to move the stolen assets from the Solana blockchain to the Ethereum blockchain. This process, which took approximately eight hours, required Circle’s active involvement through its burning and minting mechanisms. Warnings about the exploit and explicit calls for Circle to intervene were posted on X.com within an hour of the attack, with Drift Protocol itself announcing the breach and stating, “This is not an April Fools’ joke.”

Despite having the capability to freeze assets and block wallet addresses, Circle reportedly allowed over $230 million in stolen funds to be transferred through its services in more than 100 separate transactions. Circle CEO Jeremy Allaire later defended the company’s inaction, citing a “moral quandary” regarding intervention.

The named plaintiffs, including Joshua McCollum and Oakford Crawson LLC, represent a proposed class of individuals and entities who owned cryptocurrency stolen in the April 1, 2026, Drift exploit and subsequently transferred via Circle’s USDC and CCTP to the Ethereum blockchain. These plaintiffs collectively lost approximately $1.46 million, with individual losses ranging from $6,500 to $1 million.

The legal claims filed include aiding and abetting conversion, asserting that Circle substantially assisted the attackers by providing bridging services with knowledge that the property was stolen. A second claim alleges negligence, arguing that Circle breached its duty by failing to freeze the assets despite its unique position to prevent the harm.

The plaintiffs are seeking class certification, monetary damages, punitive damages, pre-judgment interest, and attorney fees. The court has jurisdiction under the Class Action Fairness Act, given the diverse citizenship of the parties, the anticipated number of class members exceeding 100, and damages surpassing $5 million.

Please contact BlockTribune for access to a copy of this filing.