Manuel Aráoz, co-founder of blockchain security firm OpenZeppelin, has issued an unprecedented public warning urging users to withdraw all funds from decentralized finance (DeFi) protocols, including major platforms like Aave, Compound, and MakerDAO. In a post on X, Aráoz said he now considers “all of DeFi” unsafe, arguing that AI-powered coding agents have made attackers “superhuman at finding vulnerabilities.”
The core of his argument centers on an asymmetry that favors hackers: defenders must identify and fix every possible bug across complex smart contract code, while an attacker augmented by AI only needs to find a single exploitable flaw to drain all liquidity. “Defenders need to fix every bug while attackers need just one exploit to steal funds,” Aráoz wrote, adding he has been privately advising friends and family to exit even “low-risk blue chips” like Aave, MakerDAO, and Compound.
This warning carries significant weight given Aráoz’s role at OpenZeppelin, whose contracts library underpins a vast portion of Ethereum-based DeFi. It also arrives amid one of the worst periods for DeFi exploits in over a year. According to data from DefiLlama, $629.7 million was stolen from DeFi protocols in April alone, making it the worst month since the February 2025 Bybit hack. Two large-scale attacks accounted for most of the losses: Drift Protocol lost about $285 million in a social engineering campaign, and Kelp DAO suffered a $293 million exploit tied to cross-chain bridge vulnerabilities.
The total value locked (TVL) across DeFi markets has dropped roughly 14% since mid-April, falling from nearly $172 billion to around $148 billion, as exploit incidents continued into May. Recent cases include a $11.6 million breach on Verus Network’s Ethereum bridge and a $573,200 exploit on Polymarket linked to a compromised private key. Aráoz’s warning highlights a growing belief that traditional smart contract audits and human-led security teams can no longer keep pace with AI-driven attacks, forcing the industry to confront a fundamental rethink of DeFi safety.
