Circle is facing a class action lawsuit from a group of Drift Protocol investors who lost money in the $280 million exploit on April 1, one of the largest hacks in DeFi history.

The lawsuit, filed Tuesday by law firm Gibbs Mura, accused Circle Internet Financial of failing to act swiftly to freeze the stolen USDC (USDC) tied to the attack.

"Circle allegedly took no action to freeze the funds, despite having the technical and contractual authority to do so," the lawyers said in a statement on Wednesday.

Drift Protocol, a Solana-based decentralized exchange, suffered an exploit after an attacker gained unauthorized access to the platform, introduced a malicious asset, and removed withdrawal limits to drain the funds, the Drift team said. The incident gained more traction after Drift revealed the perpetrators had spent six months posing as a quantitative trading firm.

Onchain investigator ZachXBT has criticized Circle for not freezing USDC linked to the exploit quickly enough. "[Six] hours is how long Circle had to freeze stolen funds from the $280M+ Drift hack," ZachXBT wrote, alleging that the attacker moved over $230 million worth of USDC from Solana to Ethereum via Circle's cross-chain transfer protocol.

The lawsuit further alleged that, nine days earlier, Circle had frozen 16 unrelated wallets in a separate civil case, "demonstrating both the capability and willingness to act."

Moral quandary

In a press conference earlier this week, Circle CEO Jeremy Allaire defended the company's decision, saying that the company only freezes USDC wallets at the direction of law enforcement or the courts. Allaire added that taking action outside established legal processes in private matters could become a "significant moral quandary."

"If there are others that believe that Circle should just step away from what the law says and do its own, make its own decisions, I think it's a very risky proposition," Allaire said.

The Block has reached out to Circle for comment on the class action lawsuit.

Meanwhile, Drift said Thursday that it has secured a proposed recovery package of up to $127.5 million from Tether and $20 million from other partners. 

"The structure is intended to support user recovery following the April 1 exploit and facilitate Drift’s relaunch as the largest USDT-based perpetual DEX on Solana," said the Drift team.