OpenZeppelin Co-founder: "All DeFi is insecure," has advised friends and family to withdraw funds

May 27: Manuel Aráoz, co-founder of crypto security firm OpenZeppelin, posted on social media that he now believes the entire DeFi sector is insecure. He has begun advising friends and family to exit all their DeFi positions—even supposedly low-risk positions in blue-chip protocols like Aave, MakerDAO, and Compound. Aráoz pointed out the asymmetric dynamic between attackers and defenders in security incidents: “Auditors are far better at finding vulnerabilities, but smart contract security is too lopsided. Defenders have to fix every single bug, while attackers only need to find one to steal funds.” His comments reflect heightened market concern over DeFi security after a string of major incidents in recent months. Data shows April saw nearly $630 million hacked from DeFi protocols, making it the worst month since the $1.5 billion Bybit hack in February 2025. April’s exploits, including Drift’s $285 million loss and Kelp DAO’s $293 million loss, are widely tied to North Korean government-linked hackers. Market confidence in DeFi has been significantly shaken: Total Value Locked (TVL) in protocols has dropped roughly 14% since mid-April, from around $172 billion to $148 billion. So far in May, there have been 25 security incidents, including the Verus Network cross-chain bridge exploit that lost $11.6 million and prediction market platform Polymarket’s disclosure of a ~$570,000 security vulnerability.