Major

DeFi

April

Security

Surge

<h3 id="what-to-know">What to know:</h3>
<ul>
 <li>Manuel Aráoz warned investors against holding DeFi positions amid rising exploit threats.</li>
 <li>DeFi protocols recorded nearly $630 million in losses during April’s exploit incidents.</li>
 <li>Declining DeFi total value locked reflects weakening investor confidence across protocols.</li>
</ul>
Manuel Aráoz, co-founder of OpenZeppelin, has warned that decentralized finance no longer provides a safe environment for investors, revealing that he has already advised friends and family members to withdraw all DeFi-related positions despite the presence of established protocols that many users still consider relatively secure. 
According to <a href="https://x.com/maraoz/status/2059413451265441990" rel="noopener noreferrer nofollow">statements</a> Aráoz shared on X, his concerns extend beyond smaller platforms and also include exposure to recognized lending protocols such as Aave, MakerDAO, and Compound, which have traditionally maintained stronger reputations within the decentralized finance sector. 
Aráoz explained that the rapid advancement of automated coding agents has significantly shifted the balance between attackers and developers because these systems can identify vulnerabilities at a speed that security teams increasingly struggle to match, thereby creating an environment where exploit risks continue expanding across multiple protocols. 
Additionally, according to Aráoz, smart contract security remains heavily asymmetric because protocol developers must eliminate every possible vulnerability before deployment, while attackers only require one successful exploit to drain millions of dollars from affected platforms within minutes. 
His warning emerged during a period where decentralized finance protocols continue experiencing repeated security incidents involving cross-chain bridges, lending systems, and internal wallet operations, despite increased spending on audits and infrastructure upgrades throughout the sector. 
<div class="embed-twitter">
 <blockquote class="twitter-tweet">
 PSA: I now consider *all* of DeFi unsafe. 
 Coding agents are superhuman at finding vulnerabilities, and smart contract security is too asymmetric: defenders need to fix every bug while attackers need just one exploit to steal funds. 
 — Manuel Aráoz (@maraoz) <a href="https://twitter.com/maraoz/status/2059413451265441990?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">May 26, 2026</a> 
 </blockquote>
</div>
Also Read: <a href="https://36crypto.com/alert-xrp-open-interest-surges-to-79m-across-major-exchanges-amid-price-stall-what-this-means/" rel="noopener noreferrer nofollow">Alert: XRP Open Interest Surges to 79M Across Major Exchanges Amid Price Stall – What This Means</a> 
<h2 id="major-exploits-continue-weakening-confidence-across-defi-platforms">Major Exploits Continue Weakening Confidence Across DeFi Platforms</h2>
According to DeFiLlama <a href="https://defillama.com/hacks" rel="noopener noreferrer nofollow">data</a>, decentralized finance protocols recorded nearly $630 million in exploit-related losses during April through 27 separate security incidents, making it the sector’s worst month for hacks since the $1.5 billion Bybit breach that occurred earlier this year. 
Among the largest incidents reported during the month, hackers <a href="https://36crypto.com/drift-hack-update-attackers-contacted-as-solana-ecosystem-faces-wider-impact/" rel="noopener noreferrer nofollow">exploited Drift</a> through a social engineering campaign that reportedly lasted for six months before attackers successfully drained more than $285 million from the protocol’s infrastructure. 
Moreover, attackers targeted a cross-chain bridge vulnerability connected to Kelp DAO, resulting in losses approaching $293 million and further increasing concerns surrounding bridge security across decentralized finance ecosystems. 
Reports linked both exploits to<a href="https://36crypto.com/north-korean-hackers-steal-23m-from-uk-crypto-exchange-in-major-breach/" rel="noopener noreferrer nofollow">North Korean state-backed hacking</a> groups, while the repeated scale of these incidents increased concerns surrounding whether current DeFi security models remain capable of handling increasingly sophisticated attacks. 
The broader decentralized finance market has also reflected weakening investor confidence because total value locked across protocols declined from nearly $172 billion in mid-April to roughly $148 billion within recent weeks as exploit activity continued rising. 
May has continued showing similar security challenges, although reported losses remained smaller, with Verus Network confirming an Ethereum bridge exploit worth approximately $11.6 million while Polymarket acknowledged a separate $573,200 breach connected to a possible private key compromise involving internal wallet operations. 
<h2 id="conclusion">Conclusion</h2>
Aráoz’s warning has added to growing concerns surrounding decentralized finance security as repeated exploit incidents continue affecting both major protocols and smaller platforms, while declining total value locked figures suggest investors remain increasingly cautious despite ongoing attempts to strengthen security protections across the sector. 
Also Read: <a href="https://36crypto.com/ripple-engineer-reveals-xrpl-security-advantage-after-3m-wallet-exploit/" rel="noopener noreferrer nofollow">Ripple Engineer Reveals XRPL Security Advantage After $3M Wallet Exploit</a> 
The post <a href="https://36crypto.com/openzeppelin-co-founder-warns-defi-is-unsafe-after-exploit-surge-grows/" rel="noopener noreferrer nofollow">OpenZeppelin Co-Founder Warns DeFi Is Unsafe After Exploit Surge Grows</a> appeared first on <a href="https://36crypto.com" rel="noopener noreferrer nofollow">36Crypto</a>.

OpenZeppelin Co-Founder Warns DeFi Is Unsafe After Exploit Surge Grows

Table of Contents

36crypto

Other articles published on May 27, 2026

Join our free newsletter for daily crypto updates!