U.S. law firm Gibbs Mura announced the initiation of a class action investigation into the Drift Protocol hack, one of the largest DeFi exploits ever, resulting in the theft of approximately $280–$285 million in assets. The investigation centers on Circle Internet Financial and its potential liability for failing to freeze funds despite having the technical capability to do so. The hacker transferred over $230 million in USDC to Ethereum via Circle's Cross-Chain Transfer Protocol (CCTP), and Circle opted not to freeze the assets.
Hack Details and Security Concerns
The breach occurred on April 1, 2026. Blockchain analytics firm Elliptic has linked the attack to a North Korean state-sponsored hacking group, known for sophisticated targeting of crypto platforms. The hacker exploited Drift's smart contracts and quickly bridged the stolen USDC to Ethereum through Circle's official cross-chain infrastructure. Circle's decision not to freeze the funds contrasts sharply with its action just days earlier, when it froze 16 commercial wallets in a separate civil dispute, raising questions about inconsistent enforcement.
Market Impact and Ecosystem Fallout
The attack devastated Drift Protocol's metrics. Total value locked (TVL) fell from $550 million to below $250 million, a drop of over 55%. The native token DRIFT experienced a price decline of more than 40% immediately following the news, though it has since rebounded 34.08% in intraday trading. At least 20 DeFi protocols with interoperability or capital exposure to Drift reported indirect losses, some suffering severe liquidity issues. Market volatility briefly affected ETH (-0.29%) while USDC remained stable (+0.01%), indicating no major flight to stablecoins.
Legal Implications and Precedent Setting
Gibbs Mura's investigation seeks to determine whether Circle's failure to freeze assets constitutes a breach of duty to investors and users. The lawsuit, if filed, could become a landmark case holding a stablecoin issuer liable for not intervening during a known hack. The timing is notable: Circle froze 16 wallets in late March 2026 for a civil matter, yet declined to act against the Drift hacker days later. This disparity may strengthen plaintiffs' claims of negligence. Drift Protocol's team continues to cooperate with security firms in fund recovery efforts, but no significant progress has been reported.