Is Carrot Liquidity Safe?
Risk Grade: C (43/100)
Carrot Liquidity is rated as elevated risk — multiple novel mechanisms and notable interaction risks.
SHUT DOWN — Protocol wind-down functionally complete as of late May 2026. ~$8M in realized losses from the Drift Protocol exploit (April 1, 2026). Drift rebranded to Velocity DEX (July 1, 2026) with Tether's $127.5M commitment confirmed; private beta launched. DFX recovery token claim checker live (view-only) but pool remains below $5M early-redemption threshold as of July 1-2, 2026. Critical complication: the Drift exploiter (attributed to DPRK/Lazarus Group) laundered $44.4M ETH through Tornado Cash on July 23-24, 2026, materially reducing direct fund recovery probability. Full recovery for Carrot CRT holders remains contingent on Velocity DEX generating sufficient trading revenue to fund the $150M recovery pool.
Carrot Liquidity is a Solana yield aggregator that automatically routed stablecoin deposits across lending platforms. The protocol shut down after suffering approximately $8M in losses from the Drift Protocol exploit (April 1, 2026). The May 14, 2026 withdrawal deadline has passed and wind-down is functionally complete.
TVL
$2,000
Mechanisms
5
Interactions
4
Value Grade
D-
Key Risks for Carrot Liquidity Users
PROTOCOL SHUT DOWN: Wind-down is functionally complete with TVL at ~$2K. Any remaining CRT holders should contact the Carrot team immediately. Drift rebranded to Velocity DEX (July 1, 2026) — recovery via DFX tokens is possible but pool remains below the $5M early-redemption threshold and the exploiter laundered $44.4M through Tornado Cash on July 23-24, 2026.
Inherited protocol risks materialized: Carrot's exposure to Drift Protocol's lending markets resulted in approximately $8M in losses when Drift was exploited on April 1, 2026 — demonstrating how routing funds across multiple protocols aggregates third-party risk.
No revenue model: Carrot charged zero management fees, which contributed to the decision to shut down once losses reduced TVL to an economically unviable level.
Top Risk Factors
- •Protocol shutdown functionally complete. Forced deleveraging after May 14, 2026 withdrawal deadline is essentially done; TVL stands at ~$2K (residual abandoned liquidity). ~$8M in losses from the Drift Protocol exploit (April 1, 2026). Drift rebranded to Velocity DEX (July 1, 2026) and launched private beta, but DFX recovery pool remains below the $5M early-redemption threshold. Critical new development: the Drift exploiter (attributed to DPRK's Lazarus Group) laundered $44.4M ETH through Tornado Cash on July 23-24, 2026, materially reducing direct fund recovery probability.
- •Automated yield routing across multiple Solana lending platforms (Kamino, MarginFi, Drift, etc.) means depositors inherit the smart contract risks of every underlying protocol — a risk that materialized when Drift was exploited for $285M
- •CRT yield-bearing token exchange rate depends on the aggregate performance of underlying lending strategies; the Drift exploit caused a ~90% TVL collapse from peak of ~$28M, directly impacting all CRT holders
How Carrot Liquidity Compares to Peers
Carrot Liquidity ranks #87 of 121 Yield protocols (below-median — riskier than average). At a risk score of 43/100, it's 5 points riskier than the sector average of 38/100.
Adjacent peers: Lorenzo sUSD1+ (C+, 42/100) is ranked just safer, and BitFi BTC (C, 43/100) is ranked just riskier.
See the full Yield sector leaderboard or the Carrot Liquidity vs BitFi BTC comparison.
Common Questions about Carrot Liquidity
Plain-English answers based on Carrot Liquidity's scores across Hindenrank's 8 risk dimensions. The highest-scoring (riskiest) dimension is Track Record (15/15).
Has Carrot Liquidity ever been hacked or exploited?
Carrot Liquidity has a documented incident history that materially raised its risk grade — the track record dimension scored 15/15, near the high end of the scale. Past exploits, governance failures, or contract issues are baked into this rating. Anyone considering deposits should review the incident details before allocating capital.
How much money is at stake in Carrot Liquidity?
Carrot Liquidity currently holds a small TVL — exit liquidity is a real concern at this size. Smaller TVL means individual depositors carry a larger share of any loss event, and it can be harder to exit a position quickly during stress.
What's the worst-case scenario for Carrot Liquidity?
Hindenrank has identified specific collapse scenarios for Carrot Liquidity. The most prominent: "Underlying Lending Protocol Exploit Affecting CRT Holders". The trigger condition is One of the Solana lending protocols in Carrot's routing strategy (Kamino, MarginFi, etc.) suffers a smart contract exploit or bad debt event. Reading through the full scenario list on the protocol page is the single best way to understand the actual failure modes — generic "smart contract risk" is rarely the thing that takes a protocol down.
Is Carrot Liquidity regulated or insured?
Carrot Liquidity has some regulatory exposure (4/10), typical of mid-sized DeFi protocols. There is no specific enforcement action on record, but the structure includes elements that regulators have flagged in similar protocols. No DeFi protocol carries FDIC-style insurance — even with low regulatory risk, depositors are not protected in the way bank customers are.
What are the biggest red flags for Carrot Liquidity?
Hindenrank's retail-focused risk audit flagged: PROTOCOL SHUT DOWN: Wind-down is functionally complete with TVL at ~$2K. Any remaining CRT holders should contact the Carrot team immediately. Drift rebranded to Velocity DEX (July 1, 2026) — recovery via DFX tokens is possible but pool remains below the $5M early-redemption threshold and the exploiter laundered $44.4M through Tornado Cash on July 23-24, 2026. Inherited protocol risks materialized: Carrot's exposure to Drift Protocol's lending markets resulted in approximately $8M in losses when Drift was exploited on April 1, 2026 — demonstrating how routing funds across multiple protocols aggregates third-party risk. No revenue model: Carrot charged zero management fees, which contributed to the decision to shut down once losses reduced TVL to an economically unviable level.
Should beginners deposit into Carrot Liquidity?
Carrot Liquidity's C grade puts it in the elevated-risk band. This is not a beginner-friendly protocol. Anyone depositing here should treat the position as speculative and avoid concentrating significant savings in it.
How does Carrot Liquidity compare to safer Yield alternatives?
Carrot Liquidity is one protocol in Hindenrank's Yield coverage. The safest Yield protocols on the leaderboard tend to share three traits: a long incident-free track record, conservative mechanism design, and high-quality public documentation. Compare Carrot Liquidity against the full Yield ranking before committing capital.
For the full 8-dimension score breakdown, the radar chart, and dependency graph, see the Carrot Liquidity risk report.
Read the Full Carrot Liquidity Risk Report
This protocol has 3 collapse scenarios. 1 high-severity interaction risks identified. See the full mechanism classification, interaction matrix, and deep-dive recommendations.
View Full Report →Get risk alerts before it's too late
Weekly grade changes, downgrade alerts, and new protocol risk findings. Free.