Drift Hack: How North Korea Moved $230M Through Circle, and the Lawsuit That Followed

Shortly after noon in New York on 1 April 2026, the people who had just emptied Drift Protocol started moving the money. They swapped dozens of stolen tokens into USDC, the digital dollar issued by Circle Internet Group, and sent it across Circle's own transfer service from the Solana blockchain to Ethereum. Over roughly six hours, in more than 100 transfers, about $230 million went through. It was a normal working Wednesday at Circle's offices. Circle, which can freeze any USDC address with a single instruction, froze nothing.

How the theft itself worked, a fake trading firm, six months of friendship and two pre-signed admin transactions, is told in the main Drift story. This one is about what came after: who was behind it, the six hours, and a class action in a Boston federal court that asks whether a stablecoin issuer owes anything to the victims of a theft it watched pass through its pipes.

Who did it

The first attribution came within a day. On 2 April the blockchain analytics firm Elliptic said it had found "multiple indicators" linking the attack to North Korea, citing laundering patterns and network signals seen in earlier North Korean hacks. By Elliptic's count it was the eighteenth North Korea-linked theft of 2026, taking the year's total past $300 million. TRM Labs, a rival firm, reached the same view, and Ledger's chief technology officer, Charles Guillemet, said the method resembled the $1.5 billion Bybit theft of 2025.

On 5 April Drift published its own findings, supported by SEAL 911, a volunteer crypto security response team. With what it called medium-high confidence, Drift said the operation was run by the same people behind the October 2024 hack of Radiant Capital, a lending app that lost more than $50 million. The evidence was money: funds used to stage the Drift attack traced back to Radiant's attackers. Mandiant, the investigator owned by Google, had already tied Radiant to a North Korean group it tracks as UNC4736, also known as AppleJeus or Citrine Sleet. Drift added that the people its staff met at conferences were probably not North Koreans themselves but hired intermediaries.

In June Drift said Mandiant, hired to examine the compromised devices, had attributed the attack to a North Korean group it labels UNC6862. Much of the press uses "Lazarus Group" as shorthand for all of these units; the forensic firms use narrower names. No one has been charged, and North Korea does not answer extradition requests.

Six hours on Circle's bridge

USDC is a stablecoin: a token that Circle promises to redeem for one US dollar, backed by cash and short-term Treasury bills, a little like a bank deposit that lives on a blockchain. Circle's Cross-Chain Transfer Protocol (CCTP) moves USDC between blockchains by destroying it on one and creating the same amount on the other, the way a bank might debit one branch and credit another. Every dollar passes through Circle's system. Circle also has a blacklist: it can freeze any address holding USDC, and it has used that power before.

The attacker chose USDC anyway. The investigator ZachXBT, who watched the transfers live, wrote that "Circle was asleep" while many millions moved "for hours" during US business hours. On the Ethereum side the USDC was swapped into about 129,000 ETH, spread across four wallets.

Critics pointed to 23 March, nine days before the hack. That day Circle froze USDC in 16 business wallets, one of them tied to the DFINITY Foundation, on the orders of a sealed US civil case, with no public explanation. The point, as critics put it, was not that the freeze was wrong but that Circle could clearly act quickly when a court told it to.

Circle's answer

Circle's chief executive, Jeremy Allaire, answered in Seoul in mid-April. "Circle has a very, very clear performance obligation under the law," he said, according to CoinDesk, adding that Circle freezes a wallet "at the direction of law enforcement or the courts." In his account, an issuer that froze money on its own judgement would be a private company deciding who owns what. He said Circle wanted a legal safe harbour, protection from being sued for acting, written into the CLARITY Act, the US market structure bill then before Congress.

Drift's successor exchange, Velocity, has since dropped USDC and settles all trades in Tether's USDT. Tether, which has frozen stolen funds on request many times, also pledged up to $127.5 million to Drift's recovery.

The lawsuit

On 14 April Joshua McCollum, a Drift user, filed a class action against Circle Internet Group and Circle Internet Financial in the US District Court for Massachusetts. An amended complaint on 11 May added six more plaintiffs, including Oakford Crawson LLC. The claims are negligence and aiding and abetting conversion, the legal term for knowingly helping someone handle stolen property. The complaint says the losses "would not have occurred, or would have been substantially reduced" if Circle had acted. The plaintiffs are represented by Gibbs Mura and Bailey & Glasser; Circle by Jones Day.

The judge is William G. Young, a senior federal judge known for running a fast courtroom. In June he refused a joint request for a month's extension, writing on the docket that it was too leisurely an approach to serious litigation. Circle moved to dismiss the case. On 30 June the US Chamber of Commerce filed a brief in its support, arguing that Circle cannot be held liable because third parties misused its platform. On 27 July Judge Young refused Circle's request to pause the exchange of evidence while the motion was pending. He allowed a second amended complaint on 6 August. The hearing on Circle's motion to dismiss was moved from 28 September to 29 October 2026, in person in Courtroom 18 in Boston.

Where the money is now

Most of it has not moved. At the start of October three attacker wallets still held 107,165 ETH, worth close to $286 million. On 23 and 24 July a fourth wallet, labelled "Drift Exploiter 4" on the Etherscan explorer, pushed 23,095 ETH, about $44.4 million, into Tornado Cash in batches of 100, 10 and 1 ETH. When a researcher tagged ZachXBT, he replied that he had no plans to track the funds further: following a nine-figure North Korean theft and chasing freezes was, he wrote, "not feasible for a single person", and Drift was not a client or donor.

About $9.2 million has been frozen, but it cannot reach victims without a law enforcement order. Drift's victims have so far been offered about one cent per dollar.