Carrot protocol shuts down after $285M hack

DRIFT

2026

DEFI

APRIL

CRT

Solana-based decentralized finance yield protocol Carrot announced on April 30 that it is shutting down permanently.

This makes it one of the first DeFi protocols to collapse as a direct consequence of the Drift Protocol exploit that rocked the ecosystem in early April.

In an X post, Carrot described the Drift hack as "catastrophic" for its operations, saying it had been left financially unable to continue.

The platform has set May 14 as the deadline for users to withdraw any remaining funds from its Boost, Turbo, and CRT products before it begins deleveraging the system.

"Your deposited funds are still yours, but all leverage will be reduced to zero, freeing up all liquidity for CRT redemption," the team said.

Carrot added that it will continue to support recovery efforts related to Drift and distribute assets to users once they become available.

The collapse was swift and brutal in terms of total value locked.

According to DefiLlama data, Carrot's total value locked stood at approximately $11.4 million on March 31, before the Drift hack.

It currently sits at $1.18 million, an almost 90% collapse. Carrot had been deeply integrated with Drift's infrastructure, using its liquidity pools to generate yield for users, which meant that when Drift's TVL was drained, Carrot had nowhere to turn.

More News:

The Drift hack was a months-long coordinated attack

The Drift Protocol exploit on April 1 was a highly coordinated attack that investigators say involved months of social engineering.

A group of hackers methodically worked their way into administrative control of the protocol before draining more than half of its total value locked, which led to a loss of $285 million.

It is the second-largest DeFi exploit of 2026 so far, behind only the $293 million hack on liquid staking protocol Kelp, which currently holds the grim distinction of being the year's largest exploit.

Crypto hacks batter April

April 2026 recorded $629.69 million in total crypto losses, the highest ever in a single month, with DeFi protocols accounting for $614.17 million of that figure.

The two major exploits that accounted for 93% of total losses include:

Drift Protocol (April 1): $285 million.
KelpDAO (April 18): $293 million.

Other exploits included:

Rhea Finance: $18.4 million via flash loan manipulation; Tether froze $3.29 million
Grinex: $13.74 million in USDT split across 54 wallets and converted via SunSwap.
Resolv Labs: $23 million.
Volo Protocol: $3.5 million
CoW Swap: $1.2 million via domain hijacking
Hyperbridge: $2.5 million on the Polkadot network
Sweat Foundation: approximately $3.5 million
Wasabi Protocol: $4.55 million via compromised deployer admin key on Ethereum and Base
Aftermath Perps: approximately $1.14 million
Dango: $410,000 via smart contract bug
Silo Finance: $392,000 due to a misconfigured oracle.

Nigeria Stablecoin Summit: Stakeholders champion real-world use cases for explosive adoption