Drift Exploit Forces DeFi Carrot to Halt Operations and Withdrawals

TLDR

• DeFi protocol Carrot confirmed it will shut down after losses linked to the Drift exploit.
• The platform set May 14 as the deadline for users to withdraw remaining funds.
• Carrot reported that its total value locked fell from $28 million to $1.99 million after the attack.
• The Drift exploit involved hackers gaining admin access and draining over half of its total value locked.
• Several connected platforms faced losses due to shared integrations with Drift’s infrastructure.

Carrot, a Solana-based DeFi yield protocol, confirmed its permanent shutdown following losses linked to the Drift exploit. The team set May 14 as the final deadline for users to withdraw remaining funds. The decision follows a sharp drop in total value locked after the April 1 security breach.

DeFi Carrot Halts Operations After Drift-linked Losses

Carrot announced its closure through an X post, citing financial damage from the Drift exploit. The team described the incident as “catastrophic” and confirmed it could not sustain operations. It also stated that users must withdraw assets before the May 14 deadline.

The platform said, “Your deposited funds are still yours, but all leverage will be reduced to zero.” It added that deleveraging will free liquidity for CRT redemption. The protocol also confirmed continued support for recovery efforts tied to Drift.

Carrot relied on Drift’s infrastructure to generate yield, which increased its exposure to the exploit. After the attack, its total value locked dropped from $28 million to $1.99 million. This decline reflects a loss of about 93%, based on DefiLlama data.

Drift Exploit Spreads Losses Across Linked Platforms

The Drift exploit on April 1 ranked as the second-largest crypto attack in 2026. Hackers used social engineering over several months to gain administrative access. They then drained more than half of Drift’s total value locked.

The incident affected several connected projects, including Gauntlet, PrimeFi, and Elemental DeFi. These platforms faced liquidity pressure due to shared integrations with Drift. Carrot became one of the earliest platforms to shut down due to this exposure.

Carrot confirmed it will assist in distributing recovered assets once they become available. The team stated it will coordinate with relevant parties during the recovery process. It also confirmed that leverage across its products will drop to zero during the transition.

Crypto Losses Surge as April Records $630M in Exploits

DefiLlama data shows that April recorded about $630 million in stolen digital assets across 25 incidents. This total marks the highest monthly loss since February 2025. That earlier period recorded $1.47 billion in losses.

The $293 million exploit on liquid staking protocol Kelp remains the largest attack in 2026. The Drift exploit follows closely with losses of $285 million. Together, these two incidents account for over 90% of April’s total losses.

Carrot’s shutdown highlights the direct impact of interconnected DeFi systems during security breaches. The platform’s integration with Drift exposed it to rapid liquidity loss. The withdrawal deadline of May 14 remains in effect for all users.

The post Drift Exploit Forces DeFi Carrot to Halt Operations and Withdrawals appeared first on CoinCentral.