Is Carrot Lend Safe?
Risk Grade: C (43/100)
Carrot Lend is rated as elevated risk — multiple novel mechanisms and notable interaction risks.
SHUTDOWN — Protocol ceased operations April 30, 2026 following cascading losses from Drift Protocol exploit. Drift rebranded as Velocity DEX (July 1, 2026); private beta underway, public launch Q3 2026. Recovery pool below $5M threshold; hacker moved $44.4M through Tornado Cash July 23–24 — darkening recovery prospects. Carrot IOU distribution contingent on Velocity DEX relaunch and pool seeding.
Carrot Lend was a Solana yield optimizer that automatically routed stablecoin deposits across top lending protocols (Drift, Kamino, MarginFi, Jupiter, Save) to capture the best available rates. The protocol shut down April 30, 2026 after cascading losses from the Drift Protocol exploit (April 1, 2026, $295M, DPRK/Lazarus Group) caused TVL to collapse from ~$28M to ~$68K (~$8M in direct losses). The voluntary withdrawal deadline (May 14, 2026) has passed; forced deleveraging of all Boost, Turbo, and CRT positions is underway. Drift rebranded to Velocity DEX on July 1, 2026 and launched a private beta, with public relaunch targeting Q3 2026. The recovery pool (~$3.8M USDT) remains below the $5M redemption activation threshold; Tether's $127.5M commitment is a revenue-contingent credit line, not deposited cash. On July 23–24, 2026, a hacker-linked wallet moved 23,095 ETH (~$44.4M) through Tornado Cash — with ~107,165 ETH (~$201M) still in hacker-controlled wallets — materially reducing prospects for on-chain asset recovery. Carrot CRT snapshot holders (April 1, 20:00 UTC) remain eligible for the IOU token distribution, which is contingent entirely on Velocity DEX recovery progress. No distribution timeline has been announced.
TVL
$68,215
Mechanisms
5
Interactions
4
Value Grade
D-
Key Risks for Carrot Lend Users
SHUTDOWN: Voluntary withdrawal deadline (May 14, 2026) has passed. Forced deleveraging is underway — all remaining Boost, Turbo, and CRT positions are being wound down.
Hacker laundering escalation (July 23–24, 2026): 23,095 ETH (~$44.4M) moved to Tornado Cash — materially reducing the probability of on-chain asset recovery from the $295M Drift exploit. ~107,165 ETH (~$201M) remains in hacker wallets.
Velocity DEX (formerly Drift) rebranded July 1, 2026; private beta underway, public Q3 2026 target. Recovery pool ~$3.8M USDT, below the $5M activation threshold. Carrot CRT snapshot holders (April 1, 20:00 UTC) remain in the IOU queue — no distribution timeline set. Tether's $127.5M credit line is revenue-contingent; analyst projections estimate multi-year recovery horizon.
Top Risk Factors
- •SHUTDOWN COMPLETE: Forced deleveraging of all Boost, Turbo, and CRT positions underway since May 14, 2026. Residual TVL (~$68K) represents positions still unwinding. No user action available beyond monitoring for Velocity DEX (formerly Drift) recovery token distribution.
- •Drift Protocol exploit (April 1, 2026, $295M, DPRK/Lazarus Group) cascaded 95%+ TVL loss for Carrot — exactly as modeled in collapse scenario cs-1. Hacker escalation: July 23–24, 2026, 23,095 ETH (~$44.4M) moved through Tornado Cash. ~107,165 ETH (~$201M) remains in hacker-controlled wallets, materially reducing on-chain recovery prospects.
- •Drift rebranded to Velocity DEX (July 1, 2026); private beta underway, public launch targeting Q3 2026. Recovery pool ~$3.8M USDT — below the $5M redemption activation threshold. Tether's $127.5M is a revenue-contingent credit line, not deposited cash. No recovery tokens distributed yet; Carrot IOU distribution is entirely contingent on Velocity DEX post-relaunch revenue generation.
- •Two audits (Sec3, MadShield) did not identify or quantify concentrated integration risk to Drift — audit scope gap exposed multi-protocol dependency risk.
How Carrot Lend Compares to Peers
Carrot Lend ranks #87 of 121 Yield protocols (below-median — riskier than average). At a risk score of 43/100, it's 5 points riskier than the sector average of 38/100.
Adjacent peers: Lorenzo sUSD1+ (C+, 42/100) is ranked just safer, and BitFi BTC (C, 43/100) is ranked just riskier.
See the full Yield sector leaderboard or the Carrot Lend vs BitFi BTC comparison.
Common Questions about Carrot Lend
Plain-English answers based on Carrot Lend's scores across Hindenrank's 8 risk dimensions. The highest-scoring (riskiest) dimension is Track Record (15/15).
Has Carrot Lend ever been hacked or exploited?
Carrot Lend has a documented incident history that materially raised its risk grade — the track record dimension scored 15/15, near the high end of the scale. Past exploits, governance failures, or contract issues are baked into this rating. Anyone considering deposits should review the incident details before allocating capital.
How much money is at stake in Carrot Lend?
Carrot Lend currently holds a small TVL — exit liquidity is a real concern at this size. Smaller TVL means individual depositors carry a larger share of any loss event, and it can be harder to exit a position quickly during stress.
What's the worst-case scenario for Carrot Lend?
Hindenrank has identified specific collapse scenarios for Carrot Lend. The most prominent: "Underlying Protocol Exploit Cascades to Carrot". The trigger condition is Exploit in one of the 5 integrated Solana lending protocols causes losses for Carrot-deposited funds. Reading through the full scenario list on the protocol page is the single best way to understand the actual failure modes — generic "smart contract risk" is rarely the thing that takes a protocol down.
Is Carrot Lend regulated or insured?
Carrot Lend has some regulatory exposure (4/10), typical of mid-sized DeFi protocols. There is no specific enforcement action on record, but the structure includes elements that regulators have flagged in similar protocols. No DeFi protocol carries FDIC-style insurance — even with low regulatory risk, depositors are not protected in the way bank customers are.
What are the biggest red flags for Carrot Lend?
Hindenrank's retail-focused risk audit flagged: SHUTDOWN: Voluntary withdrawal deadline (May 14, 2026) has passed. Forced deleveraging is underway — all remaining Boost, Turbo, and CRT positions are being wound down. Hacker laundering escalation (July 23–24, 2026): 23,095 ETH (~$44.4M) moved to Tornado Cash — materially reducing the probability of on-chain asset recovery from the $295M Drift exploit. ~107,165 ETH (~$201M) remains in hacker wallets. Velocity DEX (formerly Drift) rebranded July 1, 2026; private beta underway, public Q3 2026 target. Recovery pool ~$3.8M USDT, below the $5M activation threshold. Carrot CRT snapshot holders (April 1, 20:00 UTC) remain in the IOU queue — no distribution timeline set. Tether's $127.5M credit line is revenue-contingent; analyst projections estimate multi-year recovery horizon.
Should beginners deposit into Carrot Lend?
Carrot Lend's C grade puts it in the elevated-risk band. This is not a beginner-friendly protocol. Anyone depositing here should treat the position as speculative and avoid concentrating significant savings in it.
How does Carrot Lend compare to safer Yield alternatives?
Carrot Lend is one protocol in Hindenrank's Yield coverage. The safest Yield protocols on the leaderboard tend to share three traits: a long incident-free track record, conservative mechanism design, and high-quality public documentation. Compare Carrot Lend against the full Yield ranking before committing capital.
For the full 8-dimension score breakdown, the radar chart, and dependency graph, see the Carrot Lend risk report.
Read the Full Carrot Lend Risk Report
This protocol has 2 collapse scenarios. 1 high-severity interaction risks identified. See the full mechanism classification, interaction matrix, and deep-dive recommendations.
View Full Report →Get risk alerts before it's too late
Weekly grade changes, downgrade alerts, and new protocol risk findings. Free.