color: var(color-red-500)

by

OpenZeppelin’s Manuel Aráoz advises exiting DeFi, calls it unsafe

Concerns about the safety of cryptocurrency have grown after Manuel Aráoz, co-founder of OpenZeppelin, revealed he’s told his friends and family to close out all their investments in decentralized finance, even those in well-known lending services.

Summary

  • OpenZeppelin co-founder Manuel Aráoz said he has advised friends and family to exit all DeFi positions, including exposure to Aave, MakerDAO, and Compound.
  • DeFi protocols lost nearly $630 million to hacks in April, with Drift and Kelp DAO accounting for most of the monthly losses.
  • Total value locked across the DeFi market has fallen roughly 14% since mid April as exploit incidents continued into May.

In a recent post on X (formerly Twitter), security expert Santiago Aráoz stated he believes the entire Decentralized Finance (DeFi) space is now unsafe. He explained that hackers currently have a significant advantage over those trying to protect it. His warning extended even to generally safer options within well-known platforms like Aave, MakerDAO, and Compound.

Important warning: I believe all decentralized finance (DeFi) platforms are currently risky.

AI-powered coding tools are incredibly good at discovering weaknesses in code, and the security situation with smart contracts is unbalanced. Security teams have to find and fix *every* flaw, while hackers only need to find a single vulnerability to steal money.

— Manuel Aráoz (@maraoz) May 26, 2026

According to Aráoz, tools that check smart contract code are now incredibly good at spotting weaknesses. However, developers face an uphill battle because they have to address *every* flaw, while hackers only need to find a single vulnerability to cause damage.

He’s been telling his friends and family to sell all their investments in decentralized finance (DeFi), even those considered safer options like Aave, MakerDAO, and Compound.

Aráoz made these statements while the cryptocurrency world is still recovering from a surge in damaging DeFi hacks, a trend not seen since the $1.5 billion Bybit hack in February 2025.

DeFi exploits cross $600 million in April

April was a record-breaking month for crypto hacks, with approximately $629.7 million stolen from DeFi platforms – the most in over a year. Just two separate attacks were responsible for the vast majority of these losses.

Drift Protocol suffered a significant loss of around $285 million due to a sophisticated attack. Reports indicate hackers spent six months using social engineering to gain access.

Kelp DAO was recently attacked again, losing $293 million due to weaknesses in the system it uses to move assets between different blockchains. Experts believe these attacks, along with a previous one, were carried out by hacking groups supported by the North Korean government.

In April, DefiLlama tracked 27 separate incidents where DeFi platforms were hacked or exploited. Over the same period, the total value held within these platforms decreased by roughly 14%, going from almost $172 billion to about $148 billion.

Most security breaches weren’t caused by simple coding errors, but rather by problems with how bridges between systems were secured, failures to protect privileged accounts, and human errors during regular operations.

Beyond the two major security incidents, numerous smaller attacks targeted various platforms throughout the month. As crypto.news previously covered, Wasabi Protocol suffered losses of approximately $5.5 million across the Ethereum, Base, Blast, and Berachain networks due to an ongoing exploit.

As an analyst, I’ve been following the recent security incident at Sweat Economy closely. They unfortunately experienced losses of around $3.46 million due to a fast-moving attack that emptied almost 65% of their liquidity pool in less than half a minute. The team has informed us that they’ve managed to freeze some of the stolen funds on the MEXC exchange, and they’re currently working on recovering as much as possible.

We’re happy to announce that all external account balances have been fully restored and everything is back to normal. We’re incredibly grateful for the quick support and helpful advice from the community that helped us fix this. A special thank you goes to @MEXC for quickly freezing…

— SWEAT💧 (@SweatEconomy) April 29, 2026

Recently, Aftermath Finance, a decentralized trading platform built on the Sui blockchain, suffered a loss of almost $1.1 million in USDC. The attack, which targeted their perpetuals platform, involved 11 transactions carried out over about 36 minutes, according to blockchain security firm Blockaid.

Blockaid has identified an active exploit affecting AftermathFi Perpetuals on the Sui Network. In approximately 36 minutes, an attacker drained $1.1 million USDC through 11 transactions. The attacker’s address is 0x1a65086c85114c1a3f8dc74140115c6e18438d48d33a21fd112311561112d41e. The exploit was caused by a flaw in the perpetual contract.

— Blockaid (@blockaid_) April 29, 2026

Smaller attacks continue in May

While May didn’t experience losses as significant as those in April, security problems are still happening throughout the DeFi world.

Recently, several cryptocurrency platforms have been targeted. Verus Network lost $11.6 million due to a hack of its Ethereum bridge. Additionally, Polymarket, a prediction market platform, reported a $573,200 loss, potentially caused by a compromised private key used for an internal wallet.

Read More

2026-05-27 10:58