Key Takeaways:
- Carrot ( DeFi Carrot) shut down April 30, 2026, citing the $285 million Drift Protocol exploit as the cause.
- Users have until May 14, 2026, to withdraw from Boost, Turbo, and CRT before forced deleveraging begins.
- Drift recovery distributions will be paid proportionally via IOU token, based on a CRT snapshot from April 1, 2026.
Carrot Gives Users Until May 14 to Pull Funds
The Drift hack, now the largest DeFi exploit of 2026 and the second-largest in Solana’s history, struck at roughly 20:00 UTC on April 1. Attackers, suspected to have ties to North Korean state-sponsored groups, used a novel, durable nonce exploit to compromise Drift’s administrative controls. Over 50% of Drift’s total value locked (TVL) was drained, triggering an immediate suspension of deposits and withdrawals across the platform.
Carrot held significant exposure through Drift-integrated vaults and liquidity positions. Shortly after the exploit, the team paused minting and redemption functions while assessing damage. Estimates placed roughly 50% of Carrot’s TVL at risk, with some analyses citing losses above $8 million. The protocol’s CRT net asset value was adjusted to approximately $57.52 to $57.58 per token in mid-April updates, reflecting both realized and unrealized impacts.
By late April, Carrot’s TVL had dropped sharply, and operations remained limited. The team communicated updates via X and Discord throughout, including a snapshot of CRT holdings taken on April 1 at 20:00 UTC to preserve user claims for any future Drift recovery distributions.
On April 30, @Deficarrot posted a final X thread confirming the decision. “Carrot is shutting down,” the first post read. “This is certainly not the outcome we wanted, but the situation with the Drift exploit has proven to be catastrophic for our continued operations.”
Users have until May 14, 2026, to voluntarily withdraw funds from Carrot’s three core products: Boost, Turbo, and CRT. After that deadline, the team will begin deleveraging all positions to zero leverage, effectively reducing everything to 1x and freeing liquidity for CRT redemptions.
Carrot’s Boost product allowed users to deposit yield-bearing assets such as JLP, FLP, or ONyc as collateral and choose a leverage level, with the protocol automating looping and borrowing to amplify yields. Turbo offered managed leveraged token exposure to assets including SOL, BTC, and GOLD, with dynamic leverage maintained automatically. CRT functioned as a yield-bearing stablecoin, accepting USDC, USDT, or PYUSD deposits with no lockup requirements and no management fees.
The team confirmed that deposited funds remain the property of users throughout the wind-down process. Any recovery from Drift, expected in the form of an IOU token at an undisclosed future date, will be distributed proportionally based on the April 1 CRT snapshot. Claims are preserved even after users redeem their CRT tokens.
Users who do not act before May 14 will see remaining Boost and Turbo positions force-deleveraged to 1x. The team stated that net value is not affected by this process. The Drift exploit cascaded across 15 to 20 interconnected Solana protocols that relied on Drift for liquidity, vaults, or yield strategies. Carrot was among the hardest hit due to the depth of its integration.
Drift Protocol Hack 2026: What Happened, Who Lost Money, and What’s Next
A Solana-based perpetual futures exchange lost $286 million in 12 minutes on April 1, 2026, after attackers spent three weeks…
Drift Protocol Hack 2026: What Happened, Who Lost Money, and What’s Next
A Solana-based perpetual futures exchange lost $286 million in 12 minutes on April 1, 2026, after attackers spent three weeks…
Drift Protocol Hack 2026: What Happened, Who Lost Money, and What’s Next
A Solana-based perpetual futures exchange lost $286 million in 12 minutes on April 1, 2026, after attackers spent three weeks…
The Carrot protocol operated for more than two years, building automated yield tools it described as a “yield operating system” for Solana. Its final X post reflected that history directly.
No management fees will apply during the wind-down period. Users are advised to verify wallet balances and transaction history directly on Solana block explorers and to monitor Carrot’s communication channels for any final updates or recovery timeline announcements.
