OpenZeppelin founder says he now considers 'all of DeFi' unsafe

Manuel Aráoz, co-founder of crypto security firm OpenZeppelin, said that he now considers "all of DeFi" unsafe.

In a Tuesday post on the social media platform X, Aráoz wrote that he has been personally advising friends and family to exit all DeFi positions. This includes lower-risk positions in "blue chip" protocols such as Aave, MakerDAO, and Compound.

Aráoz pointed to the ongoing asymmetry between attackers and defenders in security incidents.

"Coding agents are superhuman at finding vulnerabilities, and smart contract security is too asymmetric," Aráoz said. "Defenders need to fix every bug while attackers need just one exploit to steal funds."

The OpenZeppelin co-founder's comments reflect heightened concerns over DeFi security amid a series of major breaches in recent months. Aráoz also previously served as CTO of the firm before departing several years ago.

Worst month since Bybit

According to The Block's data dashboard, nearly $630 million was stolen from DeFi protocols in April, marking the worst month for DeFi hacks and exploits since February 2025, when Bybit was hacked for roughly $1.5 billion.

Expand Chart

April was marked by the $285 million exploit of Drift, which fell victim to a six-month social engineering scheme, and the $293 million exploit of Kelp DAO, which targeted its cross-chain bridge vulnerability. Both attacks have been widely attributed to North Korea's state-backed hackers. There were a total of 27 reported cases of DeFi exploits last month, according to DefiLlama data.

Confidence in DeFi has taken a notable hit, as reflected in the declining total value locked across protocols. DeFi TVL is down about 14% since mid-April, falling from approximately $172 billion to $148 billion.

May has also seen 25 DeFi exploits so far, though on a smaller scale. Notably, Verus Network's Ethereum bridge was exploited for $11.6 million. Prediction market platform Polymarket also acknowledged a $573,200 security breach last week, possibly linked to a private key compromise involving a wallet used for internal top-up operations.

Expand Chart