The Drift Protocol Contagion Is Still Spreading and Carrot Is the Latest Casualty

[etfs]

The full impact of the Drift Protocol hack is still being felt weeks after the initial attack, and Carrot's shutdown this week demonstrates that the damage from a major DeFi exploit does not end with the initial headlines. Carrot was integrated with Drift's infrastructure at a fundamental level, using its liquidity pools to generate the yield it offered users. When Drift's TVL was more than halved by the hack, Carrot's operational foundation collapsed with it, leaving the protocol with no viable path to continuing. The 93% TVL decline from $28 million to under $2 million is not a market sentiment reaction. It is the financial reality of a protocol whose core infrastructure was destroyed by an attack on a partner.

Carrot joins Gauntlet, PrimeFi, and Elemental DeFi as projects suffering material damage from Drift contagion, and the list may not be complete. The pattern that emerges from both the Drift and Kelp exploits in April is that DeFi's interconnected architecture, which enables the composability and yield opportunities that attract users and capital, creates systemic fragility that individual protocol audits cannot fully address. When a protocol at the center of an ecosystem is compromised, the damage radiates outward through every integration, dependency, and shared liquidity pool in ways that are difficult to predict or contain. For users, the practical lesson from Carrot's closure is to understand not just the security of the protocol you deposit into, but the security of every protocol it is integrated with, because the distinction between a direct hack and contagion from a partner hack may be irrelevant to the outcome for your funds.

[cryptohog]

The Drift hack was a six month operation and the entire DeFi security industry was looking for flash loan exploits the whole time.