Drift Exploit Claims Its First Victim as DeFi Protocol Carrot Shuts Down

Carrot, a Solana-based decentralised finance yield protocol, announced it was permanently shutting down operations, making it one of the first victims of the fallout from the Drift Protocol exploit in early April. In a post on X, Carrot stated that the Drift Protocol exploit was catastrophic and had left it financially bleeding and unable to continue. The platform has set May 14 as the deadline for users to withdraw their remaining funds. The platform will continue to assist in recovery procedures related to Drift and transfer assets when they are available.

Protocol Gives Users Withdrawal Deadline Amidst Recovery 

Carrot was earlier incorporated into Drift's infrastructure and later on used its pools to generate yield for its users. Although Carrot's Total Value Locked (TVL) collapsed after the Drift Protocol hack. As per the data from DeFiLlama, Carrot's TVL was around $28 million (roughly Rs. 266 crore) before the Drift hack; it currently stands at $1.99 million (roughly Rs. 18.9 crore), marking a decrease of roughly 93 percent. The contagion managed to spread across many affiliated projects such as the yield protocol Gauntlet, the lending and borrowing platform PrimeFi, and the crypto fund Elemental DeFi. 

In the post on X, the Carrot team assured users that they would not suffer from the exchange's closure. It said, “Your deposited funds are still yours, but all leverage will be reduced to zero, freeing up all liquidity for CRT redemption [...] Any recovery effort by Drift will still be distributed as stated previously.” The crypto firm also added, “Winding down is a hard decision for all of us who have poured so many hours and resources into Carrot.”
 
Last month, Drift Protocol fell prey to one of the biggest scams of the year, amounting to $280 million (roughly Rs. 2,600 crore). In a post on X, Drift Protocol explained that this was not a typical hack, but a months-long, highly coordinated social engineering operation. Bad actors posed as a legitimate trading firm, met the Drift Protocol executives at several crypto events. They even invested a million dollars in capital on the platform. Over time, they managed to trick team members into interacting with malicious code and apps, likely compromising their devices and gaining access to critical systems. This operation was linked to a DPRK group called UNC4736. 

Another DeFi protocol called Kelp was also on the list of growing victims of scams this year, but in the aftermath, certain DeFi protocols came together and formed an alliance to restore the backing on Restaked Ether (rsETH). The Decentralised platform Aave has called this effort “DeFI United”. Crypto protocols involved in this operation include Mantle, EtherFi Foundation, Golem Foundation, Lido DAO, Ethena, LayerZero, Ink Foundation, and Tyrdo.