TLDR
OpenZeppelin cofounder Manuel Aroz now says he considers all of DeFi unsafe and is personally telling friends and family to exit DeFi.
- Aroz argues AI coding agents are now superhuman at finding smart contract bugs, tilting the game in favor of attackers.
- His warning comes after more than $600 million was stolen from DeFi in April alone and over $1 billion in the last year, heavily from bridges and admin failures.
- For ordinary users, DeFi now looks more like a high?risk tech experiment than a savings account, so position sizing, protocol selection, and risk tools matter far more than yield.
Deep Dive
1. What He Actually Said
Manuel Aroz, cofounder of security firm OpenZeppelin, wrote on X that he now considers all of DeFi unsafe and has been advising friends and family to exit every DeFi position, including blue chip names like Aave, MakerDAO, and Compound as reported here.
He points to AI coding agents that are superhuman at finding vulnerabilities, arguing that defenders must fix every bug while attackers need only one, creating an extreme security asymmetry. A separate interview notes similar concerns that modern AI models can autonomously discover and weaponize smart contract exploits faster than humans can patch them according to this analysis.
2. Why DeFi Risk Has Spiked
Arozs comments land in a very bad stretch for DeFi security. DeFi protocols lost roughly $629630 million to hacks in April alone, the worst month in over a year, with huge incidents at Drift and KelpDAO and a string of smaller exploits afterward summarized here.
Across the last 12 months, more than $1.1 billion has been drained from DeFi, while total value locked has fallen by over $20 billion, reflecting shaken confidence per this overview. Many losses come not from simple code bugs but from cross?chain bridge design flaws, compromised admin keys, and sophisticated social?engineering campaigns, often linked to state?backed groups as detailed here.
3. How To Think About DeFi Risk Now
Arozs stance is intentionally extreme, but it highlights a practical point: DeFi behaves more like experimental high?risk infrastructure than insured banking. Even audited, blue chip apps can be hit by upstream failures (bridges, oracles, admin wallets) the average user cannot realistically evaluate.
A growing set of security researchers argue that shrinking yields and rising exploit frequency mean many users are not being paid enough for this risk, especially when comparable yields exist in traditional products as one institutional review argues.
Treat every DeFi protocol as potentially vulnerable, prioritize how much you can afford to lose, and focus on diversification, security track record, and insurance or circuit?breaker mechanisms rather than chasing the highest APY.
Conclusion
The OpenZeppelin cofounders all of DeFi is unsafe line is an opinion, but it is backed by real data: hacks are frequent, losses are large, and AI has strengthened attackers. DeFi can still be used, but it is best viewed as experimental infrastructure where careful sizing, conservative venue choice, and skepticism about low?risk yield are now essential.
CoinsKid.Com