The Solana-based decentralized finance yield protocol Carrot has declared a definitive closure following severe financial losses incurred from the Drift Protocol security breach, which rendered the platform unsustainable.
In a public statement issued on X, Carrot confirmed that the April 1 attack on Drift had devastating consequences, compelling the team to initiate a wind-down process. The protocol has set May 14 as the final date for users to retrieve their assets, after which it will begin unwinding leverage and freeing liquidity for CRT token redemption. The team emphasized that while deposited funds remain user-owned, all leveraged positions will be eliminated to facilitate withdrawal.
Carrot’s dependency on Drift’s liquidity infrastructure for yield generation proved critical when the exploit siphoned a substantial portion of Drift’s locked value. According to DefiLlama metrics, Carrot’s total value locked plummeted from approximately $28 million to $1.99 million, representing a massive 93% contraction.
Drift Protocol’s post-incident analysis revealed that the breach was the culmination of a sophisticated social engineering campaign spanning several months. The attackers, posing as representatives of a quantitative trading firm, cultivated trust with Drift contributors through in-person meetings at crypto conferences and ongoing online interactions before delivering malicious software. External assessments estimate the stolen funds at roughly $280 million, with Drift describing the operation as highly orchestrated and resource-intensive.
Investigations indicate that contact with the perpetrators began around October 2025, with the group maintaining relationships across multiple industry events to solidify credibility before compromising devices and executing the heist. Drift expressed strong confidence that the same threat actors were responsible for the October 2024 Radiant Capital breach, which resulted in $58 million in losses via Telegram-distributed malware.
The cascading effects of the Drift exploit have also impacted other integrated protocols, including Gauntlet, PrimeFi, and Elemental DeFi, all of which reported operational disruptions. DefiLlama data for April 2026 shows nearly $630 million in crypto-related losses across 25 incidents, marking the most damaging month since February 2025. The $293 million Kelp attack remains the largest single exploit of the year, closely followed by the Drift breach at roughly $285 million, with these two events accounting for over 90% of April’s total losses.
