On April 30, 2026, Carrot, a decentralized finance (DeFi) yield protocol built on Solana, officially announced its shutdown. The protocol suffered catastrophic losses exceeding $8 million in Total Value Locked (TVL) following the massive April 1 exploit targeting Drift Protocol, which drained approximately $285 million in minutes.
The Drift Exploit: A Record-Breaking Heist
On April 1 at 20:00 UTC, attackers exploited a novel persistent nonce vulnerability in Drift Protocol to compromise its administrative controls, siphoning roughly $285 million in 12 minutes. This stands as the largest DeFi exploit of 2026 and the second-largest in Solana's history. The attackers are believed to be linked to North Korean state-sponsored hacking groups.
Carrot held significant exposure through its Drift-integrated vaults and liquidity positions. Immediately after the exploit, the team paused minting and redemption functions to assess damage. Roughly 50% of Carrot's TVL was at risk, with some analyses estimating losses above $8 million. In mid-April updates, Carrot adjusted its CRT net asset value to approximately $57.52–$57.58 per token to reflect the realized and unrealized impacts.
Shutdown Decision and User Timeline
On April 30, the Carrot team posted a final thread on X confirming the decision: “Carrot is shutting down. This is certainly not the outcome we wanted, but the situation with the Drift exploit has proven to be catastrophic for our continued operations.” Users have until May 14, 2026 to voluntarily withdraw funds from Carrot's three core products: Boost, Turbo, and CRT. After that deadline, the team will deleverage all remaining positions to 1x leverage, freeing liquidity for CRT redemptions.
Product Overview and Asset Safety
Carrot's Boost product allowed users to deposit yield-bearing assets such as JLP, FLP, or ONyc as collateral and choose a leverage level, with the protocol automating looping and borrowing. Turbo offered managed leveraged token exposure to assets including SOL, BTC, and GOLD with dynamic leverage maintained automatically. CRT functioned as a yield-bearing stablecoin with no lockup or management fees.
The team confirmed that deposited funds remain the property of users throughout the wind-down process. Any recovery from Drift, expected in the form of an IOU token at an undisclosed future date, will be distributed proportionally based on the April 1 CRT snapshot. Claims are preserved even after users redeem their CRT tokens.
Users who do not act before May 14 will see remaining Boost and Turbo positions force-deleveraged to 1x. The team stated that net value is not affected by this process. The Drift exploit cascaded across 15 to 20 interconnected Solana protocols that relied on Drift for liquidity, vaults, or yield strategies; Carrot was among the hardest hit due to the depth of its integration.
Carrot operated for more than two years, building automated yield tools described as a “yield operating system” for Solana. No management fees will apply during the wind-down period. Users are advised to verify wallet balances and transaction history directly on Solana block explorers and to monitor Carrot's communication channels for any final updates or recovery timeline announcements.