Carrot DeFi Shuts Down After Drift Exploit Drains $8M

High attention and emotional sentiment detected.

The Carrot team confirmed the decision on April 30. They called the Drift exploit “catastrophic” for continued operations. As a result, users now have until May 14, 2026, to withdraw remaining funds.

What Happened to Carrot

Carrot built its two main products on top of Drift Protocol, Solana’s largest perpetuals DEX. Boost offered automated yield strategies, while Turbo provided leveraged yield positions.

Both products relied heavily on Drift’s liquidity pools. So when attackers drained approximately $285 million from Drift on April 1, 2026, Carrot’s positions collapsed.

The exploit used pre-signed durable nonce transactions along with compromised administrative keys. This allowed attackers to bypass Drift’s multisig controls, according to Yahoo Finance.

Because of the exploit, Carrot’s TVL dropped from roughly $28 million to about $1.99 million, according to DefiLlama.

This is certainly not the outcome we wanted, but the situation with the Drift exploit has proven to be catastrophic for our continued operations, the team wrote on X.

May 14 Withdrawal Deadline for Carrot DeFi Users

The team set May 14 as the final date for withdrawals. After that deadline, the protocol will deleverage all positions to 1x. That process will then free up liquidity for $CRT token redemption.

“Your deposited funds are still yours, but all leverage will be reduced to zero, freeing up all liquidity for CRT redemption,” the team wrote on X.

The team also committed to distributing any future recovery funds from Drift. This commitment aligns with earlier promises to affected Carrot users.

Drift’s Recovery Framework

Drift Protocol published a recovery update on April 16 with a plan for impacted users. As part of this plan, the protocol will issue a dedicated recovery token to each affected user.

“To streamline distribution of recovery assets and provide liquidity for impacted users, Drift will issue a dedicated recovery token,” the team wrote. This token is separate from the DRIFT governance token.

Drift’s current TVL sits at $238.24 million after partial recovery efforts, per DefiLlama. Still, no one has disclosed the exact amount Carrot users may recover.

Why Carrot DeFi Shuts Down: Composability Risk

Carrot’s collapse highlights a well-known but underestimated DeFi risk. Protocols that build on other protocols inherit all their vulnerabilities as a result.

Carrot’s Turbo product specifically relied on Drift’s stable liquidity and oracle data. Once that foundation crumbled, the leveraged yield model became unsustainable. No direct breach of Carrot’s own contracts occurred.

Some community members criticized Carrot’s risk management for relying on a single protocol. Others, though, praised the team’s transparent communication instead.

Community Reacts With Respect

Sentiment on X leaned heavily toward support for the Carrot team. Several community members called it one of the best Solana DeFi products.

“Damn, we lost a real one here. Huge thanks to the entire team for being up front and honest about everything going on,” wrote @TheLazySol.

“Sad to see you go, such a great project,” added @CloakdDev. Similarly, @metaproph3t said he was “bullish on whatever you guys do next.”

The dominant narrative is consistent across X, Reddit, and Telegram. This was a good project lost to an upstream exploit, not a rug pull.

What Comes Next

Carrot users should withdraw all funds from Boost, Turbo, and CRT positions before May 14. After that date, the protocol will reduce all leverage to zero.

Any recovery from Drift’s framework will flow through to affected depositors. The team has not shared plans for future projects yet.

Since this article discusses a protocol shutdown and fund withdrawals, readers should verify all steps through Carrot’s official channels. This is not financial advice.