Manuel Aráoz, co-founder of OpenZeppelin, a leading smart contract security company, said he strongly advises closing all DeFi positions and gives the same recommendation to people close to him.
“I mean absolutely all of them, even blue-chip protocols like Aave, MakerDAO, and Compound,” he stressed.
According to Aráoz, the core issue is a fundamental imbalance: AI agents have become superhumanly effective at identifying vulnerabilities. Defenders are still forced to patch every possible weakness, while attackers only need to find a single flaw to steal funds. In his view, the nature of smart contract security makes this asymmetry extremely difficult to overcome.
Record Losses
Earlier, we reported that April 2026 became the worst month for crypto hacks on record. According to DefiLlama, roughly 30 incidents were recorded, while total market losses reached $651 M, based on estimates from CertiK.
The biggest victims of the month were Kelp DAO, which lost $291 M, and Drift Protocol, which suffered $265 M in losses, accounting for the majority of the total damage.
Wallet compromises accounted for the largest share of attacks, representing $610 M of total losses. Only about $488,000 was recovered.
May Continues the Trend
The trend has continued this month as well. So far, 25 exploits have been recorded in May, although on a smaller scale.
For example, the Ethereum bridge of the Verus network was exploited for $11.6 M, while prediction market platform Polymarket confirmed a $573,200 exploit last week. The incident was reportedly linked to the compromise of a wallet private key used for internal operations.