Carrot to Shut Down After $285M Drift Exploit

Carrot, a Solana-based yield protocol, announced it will shut down after the April 1 exploit of the Drift protocol reduced its total value locked (TVL) from about $28 million to $1.99 million.

The team set May 14 as the deadline for users to withdraw remaining funds from Boost, Turbo and CRT pools and plans to begin winding down operations after that date.

The April 1 attack gave the attacker admin control of Drift after months of social engineering, allowing the attacker to drain more than half of Drift’s TVL. Carrot had integrated with Drift’s liquidity pools to generate yield, exposing its funds when those pools were compromised.

Data from DeFiLlama shows Carrot’s TVL fell roughly 93% from about $28 million to $1.99 million. The asset loss prevented the protocol from maintaining leveraged positions and from continuing normal operations.

The team plans to reduce all leverage to zero after the May 14 withdrawal deadline to convert leveraged positions back into base liquidity for CRT redemptions and to free liquidity for withdrawals.

In an X post, the team wrote, “Your deposited funds are still yours, but all leverage will be reduced to zero, freeing up all liquidity for CRT redemption.” The post also stated the team will support Drift recovery efforts and distribute any recovered assets as they become available.

On-chain trackers recorded nearly $630 million in digital assets stolen across 25 incidents in April. The Drift exploit is estimated at $285 million; another exploit on a liquid staking protocol is estimated at $293 million.

Other protocols reporting exposure to the Drift breach include Gauntlet, PrimeFi and Elemental DeFi.

The team did not provide a timeline for recoveries. Token holders are urged to withdraw balances before May 14 to preserve access to their deposits.