Manuel Aráoz, co-founder of leading blockchain security firm OpenZeppelin, has publicly stated that he now considers the entire decentralized finance (DeFi) sector unsafe. In May 27, 2026, Aráoz advised friends and family to exit all DeFi positions, including those in established “blue-chip” protocols such as Aave, MakerDAO, and Compound.
Aráoz said the rapid advancement of AI-driven coding tools has exposed a structural weakness in smart contract security, where developers are expected to eliminate every possible flaw while attackers only need a single vulnerability to carry out an exploit.
Rising AI Capabilities Tilt the Scales
Security experts have long noted challenges in auditing complex smart contracts, but advanced AI coding agents are accelerating the problem. These systems can rapidly scan publicly available on-chain code, identify subtle flaws, and generate working exploits at speeds far beyond human capabilities. Recent developments, including models capable of autonomous vulnerability discovery, have raised alarms about DeFi’s transparent architecture becoming a liability rather than a strength.
This asymmetry is not theoretical. Attackers require only a single successful vector, while protocol teams must maintain perfect defenses across thousands of lines of code, integrations, and dependencies.
PSA: I now consider *all* of DeFi unsafe.
Coding agents are superhuman at finding vulnerabilities, and smart contract security is too asymmetric: defenders need to fix every bug while attackers need just one exploit to steal funds.
— Manuel Aráoz (@maraoz) May 26, 2026
Record Losses and Declining Confidence
April 2026 proved particularly damaging for DeFi. Nearly $630 million was stolen across 27 reported DeFi exploits, marking the worst month for decentralized finance security since the Bybit incident in early 2025. Key events included:
- Drift Protocol (Solana): Approximately $285 million lost to a sophisticated six-month social engineering campaign.
- Kelp DAO: Around $293 million drained via a cross-chain bridge vulnerability, with North Korean-linked groups widely suspected.
May has seen additional incidents, including an $11.6 million exploit of Verus Network’s Ethereum bridge and a $573,200 breach at prediction market Polymarket. The growing number of attacks has also intensified concerns about a broader DeFi industry slowdown, as declining investor confidence and persistent security breaches continue to pressure user activity across decentralized finance platforms. DeFi’s total value locked (TVL) has dropped roughly 14% since mid-April, falling from about $172 billion to $148 billion. Over the past 12 months, cumulative losses from hacks exceed $1.1 billion, contributing to broader outflows and reduced user confidence.
Industry Reactions and Limitations of Current Defenses
OpenZeppelin has long been a cornerstone of DeFi security, providing audited contract libraries used across major protocols. Aráoz’s comments carry particular weight given his firm’s extensive experience conducting audits and identifying vulnerabilities. However, even extensively audited projects continue to suffer exploits, often through bridges, oracle dependencies, or operational compromises rather than pure code flaws.
Some industry participants argue the concerns may be overstated. Critics point out that many recent losses stem from human factors, such as private key compromises or social engineering rather than purely AI-discovered smart contract bugs. Others emphasize that AI tools could eventually strengthen defensive auditing if properly integrated.
Key Risk Factors in Current DeFi Landscape:
- Heavy reliance on cross-chain bridges with complex verification logic.
- Proliferation of unaudited or lightly audited smaller protocols.
- Increasing sophistication of state-sponsored hacking groups.
- Difficulty in achieving comprehensive formal verification at scale.
Implications for Users and Developers
For individual users, the statement underscores the need for rigorous due diligence. Holding assets in self-custody wallets, limiting exposure to any single protocol, and monitoring on-chain activity are basic precautions. Developers may need to prioritize simpler architectures, enhanced formal verification methods, and hybrid security models that combine human oversight with AI-assisted reviews.
While DeFi offers innovation in permissionless finance, these developments highlight persistent structural vulnerabilities. The sector’s growth depends on addressing this security gap before wider adoption can resume with confidence.
