Carrot Protocol
Last changed 2026-10-10 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 24 → 46. Problems weighed by who is responsible: incidents the subject suffered −20, concerns that are not fraud −6, problems around the subject, caused by others −1.5; the penalty for incidents it suffered is capped at 20; a recent unresolved incident −1.6; 2 section(s) set aside until a failed fact-check is resolved; fact-check adjustments (−8) now shown as page reliability, not in the score. Version history →
Why this score
| Every page starts at | 65 |
| Concerns that are not fraud | -6 |
| Incidents it suffered (e.g. hacks) | -20 |
| Problems around it, caused by others | -1.5 |
| Recent unresolved incident | -1.6 |
| Sum | 36 |
- The penalty for incidents it suffered is capped at 20 points.
- 2 sections set aside: the claims did not hold up in a fact-check, pending correction.
Score: 46/100 (kept between 0 and 100)
How scoring works →Summary
Carrot Protocol (also known as DeFi Carrot) was a Solana-based DeFi yield hub offering leveraged yield farming, managed leverage tokens, and a yield-bearing stablecoin receipt token (CRT). On April 30, 2026, the protocol announced a permanent shutdown after its total value locked collapsed 93% — from approximately $28 million to under $2 million — as a downstream casualty of the $285 million Drift Protocol exploit on April 1, 2026. Carrot was not directly hacked; its failure resulted from deep liquidity dependencies on Drift's infrastructure, making it the first confirmed DeFi protocol to shut down as a result of the Drift exploit contagion.
Connected Entities
15 entities · 60 linked investigations- Loopscale→mentioned with→Solana(80%)
- Loopscale→mentioned with→Wormhole(70%)
- Loopscale→mentioned with→Ethereum(60%)
- Lulo→mentioned with→Ethereum(60%)
- Lulo→mentioned with→Solana(80%)
- Fuse Wallet→mentioned with→Solana(80%)
- Fuse Wallet→mentioned with→Ethereum(60%)
- Raydium AMM→mentioned with→Solana(80%)
- Raydium AMM→mentioned with→Ethereum(65%)
- Carrot Protocol→mentioned with→Loopscale(60%)
- + 40 more
Timeline(12 events)
October 2025
Social engineering campaign targeting Drift Protocol contributors begins; threat actors posing as a quantitative trading firm begin building relationships with Drift team members
Chainalysis – Lessons from the Drift Hack11 March 2026
Attackers withdraw staging funds from Tornado Cash to begin funding infrastructure
TRM Labs – North Korean Hackers Attack Drift Protocol12 March 2026
Attackers create fabricated CarbonVote Token (CVT) with controlled supply and deploy wash trading to anchor its price at approximately $1
Chainalysis – Lessons from the Drift Hack23 March 2026
Attackers begin creating Solana durable nonce accounts and manipulating Drift Security Council members into pre-signing dormant admin transfer transactions
TRM Labs – North Korean Hackers Attack Drift Protocol26 March 2026
Drift Protocol migrates to a 2-of-5 Security Council multisig configuration with zero timelock, eliminating the detection and intervention window
Chainalysis – Lessons from the Drift HackApril 2026
Drift Protocol exploit executed: admin control transferred to attacker-controlled addresses at approximately 16:05 UTC; $285 million drained across 31 transactions in approximately 12 minutes; stolen assets bridged to Ethereum within hours
Bloomberg – Drift DeFi Project on Solana Suffers $285 Million Crypto ExploitApril 2026
Carrot Protocol suspends CRT minting and redemption in immediate response to Drift exploit; CRT snapshot taken at 20:00 UTC for future IOU token entitlement
KuCoin News Flash – 11 DeFi Protocols Affected by Drift Vulnerability2 April 2026
Drift Protocol publicly confirms exploit; Carrot publicly confirms losses with CRT holders facing an estimated 50% loss; Elliptic flags DPRK-linked indicators
CryptoTimes – Carrot Becomes First DeFi Casualty of $285M Drift Exploit5 April 2026
Drift Protocol states with medium-high confidence that the attack matches the profile of UNC4736, a North Korean state-affiliated hacking group previously attributed to the October 2024 Radiant Capital hack
Elliptic – Drift Protocol Exploited for $286 Million in Suspected DPRK-Linked Attack30 April 2026
Carrot Protocol announces permanent shutdown; team states the Drift exploit 'has proven to be catastrophic for our continued operations'; Carrot becomes the first DeFi protocol to shut down permanently as a result of the Drift contagion
CoinTelegraph – Carrot's TVL Collapses 93% in a Month Following Drift HackMay 2026
Shutdown announcement widely reported; Carrot's TVL confirmed at approximately $1.99 million, down 93% from $28 million on April 1
CryptoTimes – Carrot Becomes First DeFi Casualty of $285M Drift Exploit14 May 2026
Final voluntary withdrawal deadline for Carrot users across Boost, Turbo, and CRT products; after this date forced deleveraging to 1x leverage begins
Bitcoin.com News – Solana Yield Protocol Carrot Shuts Down After Drift Exploit Drains $8M in TVLDecision Log
- slot 455359751 · hash 9MjapRS4Rqv5Kpgq1WJQRSjD1nenZmbebogLNvHKhc5d
- slot 445507520 · hash 9b8U6Fu4teEEHoavn746oAmZGxmdQYKdHz2PAkBja2D9
- slot 419628774 · hash 5pLMffjYFr4iQkTL9sReg3o9UpPVWhK4m3MQVma28rLc
- slot 419337711 · hash FBqGYHn3rtY6akvZxgZFYf8c89iHoHxzpQvXj9oWHmKY
- slot 419337708 · hash 9Xh18pgnGMS7Mj16FD6fypoKa1JMQGShoYFgvJGg1igx
This investigation is cryptographically anchored to the Solana blockchain (5 decisions). 18 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-code-investigator
generated: 5/10/2026, 6:08:42 AM
last updated: 10/10/2026, 6:41:00 PM
5 viewsavoid.net — verified advice for a post-truth world