OpenZeppelin co-founder Manuel Aráoz says decentralized finance no longer offers a safe environment for investors. He said he has already advised friends and family to withdraw all DeFi-related positions, including exposure to protocols many users still view as relatively dependable.
In comments posted on X, Aráoz made clear that his concern is not limited to smaller platforms. He also included established lending names such as Aave, MakerDAO, and Compound in the range of protocols he would avoid, arguing that the sector’s security assumptions are under growing pressure.
Automated coding agents are shifting the balance
Aráoz said rapid progress in automated coding agents has changed the speed of the contest between attackers and developers. These systems can identify vulnerabilities faster, while security teams are finding it harder to keep up. That gap matters. It expands exploit risk across multiple protocols.
He also described smart contract security as deeply asymmetric. Developers need to remove every possible flaw before deployment, but attackers only need one working path to drain millions of dollars from a platform within minutes. The structure of the problem is old, yet the attack side is becoming more efficient.
April recorded 27 incidents and nearly $630 million in losses
Data from DeFiLlama shows DeFi protocols suffered nearly $630 million in exploit-related losses during April, spread across 27 separate incidents. That made it the sector’s worst month for hacks since the $1.5 billion Bybit breach earlier this year.
Among the largest cases, Drift was hit through a social engineering campaign that reportedly lasted six months, with attackers draining more than $285 million from the protocol’s infrastructure. Another major incident involved a cross-chain bridge vulnerability tied to Kelp DAO, where losses approached $293 million. Reports connected both exploits to North Korean state-backed hacking groups.
Falling TVL points to weaker confidence
The wider market has reflected that pressure. Total value locked across DeFi protocols fell from nearly $172 billion in mid-April to roughly $148 billion in recent weeks, a drop that aligns with rising exploit activity and a more cautious stance from investors.
May has brought similar security problems, though the disclosed losses were smaller. Verus Network confirmed an Ethereum bridge exploit worth about $11.6 million, while Polymarket acknowledged a separate $573,200 breach tied to a possible private key compromise involving internal wallet operations.
Even with heavier spending on audits and infrastructure upgrades, repeated failures across bridges, lending systems, and internal wallet processes continue to hit the sector. Aráoz’s warning landed in that setting, with risk no longer confined to fringe protocols.