Carrot shuts down after Drift exploit drains $8M

Carrot, a Solana-based yield protocol, announced it was shutting down on April 30 after exposure to the April 1 Drift Protocol exploit reduced its total value locked by roughly $8 million. Users can withdraw funds from Carrot’s Boost, Turbo and CRT products until May 14; after that date remaining leveraged positions will be force-deleveraged to 1x.

The Drift breach occurred around 20:00 UTC on April 1 and removed about $285 million from the trading protocol. Attackers exploited a durable nonce vulnerability to gain administrative controls, draining more than half of Drift’s TVL and triggering suspended deposits and withdrawals across connected platforms. The exploit affected roughly 15 to 20 Solana projects that used Drift for liquidity, vaults or yield strategies.

Carrot had multiple vaults and liquidity positions integrated with Drift, which drove its exposure. The protocol paused minting and redemptions immediately after the exploit while it assessed losses. Mid-April updates placed the CRT net asset value at about $57.52 to $57.58 per token, reflecting realized and unrealized impacts. Some analyses estimated roughly half of Carrot’s TVL was at risk, with direct losses measured at more than $8 million.

Carrot’s wind-down plan preserves user access to deposited assets. Boost allowed deposits of yield-bearing assets such as JLP, FLP or ONYC as collateral with automated looping and borrowing to increase leverage. Turbo provided managed leveraged exposure to assets including SOL, BTC and GOLD. CRT operated as a yield-bearing stablecoin accepting USDC, USDT or PYUSD with no lockups or management fees. The protocol said deposited funds remain the property of users and that no management fees will be charged during the wind-down.

To preserve claims for any future Drift recoveries, Carrot took a CRT snapshot at 20:00 UTC on April 1. Any recovery from Drift is expected to arrive as an IOU token at an undetermined date and will be distributed proportionally based on that snapshot. Carrot indicated that claims will be preserved even for users who redeem CRT tokens before any recovery distribution.

In a final thread on X, Carrot wrote: “Carrot is shutting down. This is certainly not the outcome we wanted, but the situation with the Drift exploit has proven to be catastrophic for our continued operations.” The post set the May 14 deadline for voluntary withdrawals and said remaining Boost and Turbo positions will be reduced to 1x leverage to free liquidity for CRT redemptions.

Users were advised to verify wallet balances and transaction histories on Solana block explorers and to monitor Carrot’s official X account and Discord channel for final updates and any timeline for Drift recovery distributions.