Crypto security concerns have intensified after OpenZeppelin co-founder Manuel Aráoz said he has advised friends and family to exit all decentralized finance positions, including exposure to major lending protocols.
In a post published Tuesday on X, Aráoz said he no longer considers “all of DeFi” safe, arguing that the balance between attackers and defenders has tilted too far in favor of hackers. Even lower-risk positions tied to established protocols such as Aave, MakerDAO, and Compound were included in his warning.
PSA: I now consider *all* of DeFi unsafe.
Coding agents are superhuman at finding vulnerabilities, and smart contract security is too asymmetric: defenders need to fix every bug while attackers need just one exploit to steal funds.
— Manuel Aráoz (@maraoz) May 26, 2026
Describing the current state of smart contract security, Aráoz said coding agents have become “superhuman at finding vulnerabilities,” while developers remain trapped in a system where “defenders need to fix every bug while attackers need just one exploit to steal funds.”
“I’ve been privately advising friends and family to exit all DeFi positions, including low-risk “blue chips” like Aave, MakerDAO & Compound,” he added.
Aráoz’s comments arrived as the crypto industry continues dealing with one of the most damaging periods for DeFi exploits since the $1.5 billion Bybit hack in February 2025.
DeFi exploits cross $600 million in April
Data from DefiLlama showed that roughly $629.7 million was stolen from DeFi protocols in April alone, making it the worst month for crypto-related hacks in more than a year. Two attacks accounted for most of the losses.
Among the largest incidents, Drift Protocol lost about $285 million after attackers reportedly used a social engineering campaign that lasted six months.
Kelp DAO suffered another $293 million exploit tied to vulnerabilities in its cross-chain bridge infrastructure. Security researchers and blockchain investigators have widely linked both attacks to North Korean state-backed hacking groups.
DefiLlama recorded 27 DeFi exploit incidents during April. At the same time, the total value locked across DeFi protocols dropped about 14% from mid-April levels, falling from nearly $172 billion to around $148 billion.
The concentration of losses came largely from bridge-related weaknesses, privileged access failures, and operational mistakes instead of isolated coding bugs alone.
Outside the two largest breaches, several smaller attacks continued to hit protocols through the month. As previously reported by crypto.news, Wasabi Protocol lost roughly $5.5 million across Ethereum, Base, Blast, and Berachain networks during an active exploit.
Move-to-earn platform Sweat Economy also reported losses of about $3.46 million after attackers drained nearly 65% of its liquidity pool in under 30 seconds. The project later said some of the stolen assets had been frozen on MEXC while recovery efforts continued.
We are pleased to confirm that ALL external account balances have been fully restored and operations are back to normal.
We deeply appreciate the support and advice from the community that helped us to resolve this quickly.
Special thanks goes to @MEXC for prompt freezing of… pic.twitter.com/9hvhIpmB5A
— SWEAT💧 (@SweatEconomy) April 29, 2026
Meanwhile, on the Sui blockchain, decentralized trading platform Aftermath Finance lost nearly $1.1 million in $USDC from its perpetuals platform. Blockchain security firm Blockaid said the attacker carried out 11 transactions over approximately 36 minutes.
🚨 Blockaid detected and flagged an active exploit on @AftermathFi Perpetuals on @SuiNetwork.
~$1.1M $USDC was drained across 11 transactions in ~36 minutes by attacker 0x1a65086c85114c1a3f8dc74140115c6e18438d48d33a21fd112311561112d41e. The exploit targeted a bug in the perp…— Blockaid (@blockaid_) April 29, 2026
Smaller attacks continue in May
Although May has not produced losses on the scale seen in April, security incidents have continued across the DeFi sector.
Among the latest cases, Verus Network’s Ethereum bridge was exploited for $11.6 million. Prediction market platform Polymarket also disclosed a $573,200 breach last week that the company said may have involved a compromised private key tied to an internal top-up wallet.
