Carrot Lend

Carrot Lend receives a C risk grade (43/100) from Hindenrank, where lower scores indicate lower risk. SHUTDOWN — Protocol ceased operations April 30, 2026 following cascading losses from Drift Protocol exploit. Drift rebranded as Velocity DEX (July 1, 2026); private beta underway, public launch Q3 2026. Recovery pool below $5M threshold; hacker moved $44.4M through Tornado Cash July 23–24 — darkening recovery prospects. Carrot IOU distribution contingent on Velocity DEX relaunch and pool seeding. Carrot Lend was a Solana yield optimizer that automatically routed stablecoin deposits across top lending protocols (Drift, Kamino, MarginFi, Jupiter, Save) to capture the best available rates. The protocol shut down April 30, 2026 after cascading losses from the Drift Protocol exploit (April 1, 2026, $295M, DPRK/Lazarus Group) caused TVL to collapse from ~$28M to ~$68K (~$8M in direct losses). The voluntary withdrawal deadline (May 14, 2026) has passed; forced deleveraging of all Boost, Turbo, and CRT positions is underway. Drift rebranded to Velocity DEX on July 1, 2026 and launched a private beta, with public relaunch targeting Q3 2026. The recovery pool (~$3.8M USDT) remains below the $5M redemption activation threshold; Tether's $127.5M commitment is a revenue-contingent credit line, not deposited cash. On July 23–24, 2026, a hacker-linked wallet moved 23,095 ETH (~$44.4M) through Tornado Cash — with ~107,165 ETH (~$201M) still in hacker-controlled wallets — materially reducing prospects for on-chain asset recovery. Carrot CRT snapshot holders (April 1, 20:00 UTC) remain eligible for the IOU token distribution, which is contingent entirely on Velocity DEX recovery progress. No distribution timeline has been announced.

The key risks identified for Carrot Lend are: (1) SHUTDOWN: Voluntary withdrawal deadline (May 14, 2026) has passed. Forced deleveraging is underway — all remaining Boost, Turbo, and CRT positions are being wound down. (2) Hacker laundering escalation (July 23–24, 2026): 23,095 ETH (~$44.4M) moved to Tornado Cash — materially reducing the probability of on-chain asset recovery from the $295M Drift exploit. ~107,165 ETH (~$201M) remains in hacker wallets. (3) Velocity DEX (formerly Drift) rebranded July 1, 2026; private beta underway, public Q3 2026 target. Recovery pool ~$3.8M USDT, below the $5M activation threshold. Carrot CRT snapshot holders (April 1, 20:00 UTC) remain in the IOU queue — no distribution timeline set. Tether's $127.5M credit line is revenue-contingent; analyst projections estimate multi-year recovery horizon.

Carrot Lend scores 43/100 across eight risk dimensions: Mechanism Novelty: 3/15, Interaction Severity: 5/20, Oracle Surface: 2/10, Documentation Gaps: 4/10, Track Record: 15/15, Scale Exposure: 0/10, Regulatory Risk: 4/10, Vitality Risk: 10/10. The highest risk area is Track Record at 15/15.

Among 121 rated Yield protocols on Hindenrank, Carrot Lend ranks #89 by safety (lowest risk score = safest). Its 43/100 risk score and C grade place it among the riskier Yield protocols.

Carrot Lend scores 15/15 on the Track Record risk dimension, indicating some history of security incidents or exploits. Higher scores reflect more severe or frequent incidents. Review the full risk report for details.