WuBlockchain
OpenZeppelin co-founder Manuel Aráoz said he now believes "all of DeFi is unsafe" and has personally advised friends and family to exit every DeFi position. His reasoning: AI coding agents are reaching superhuman capability in vulnerability discovery, and smart contract security is inherently asymmetric — a single bug wipes the protocol, the auditor's report is moot.
Why it matters
The quote lands hard because of who is saying it. OpenZeppelin is not a critic on the sidelines — it is one of the most respected security firms in the industry, with audit clients including Aave, Compound, MakerDAO, Uniswap and Coinbase. When a co-founder of the firm that helped certify those protocols as safe publicly tells retail to leave the sector, it reframes the entire "audited = safe" mental model the market has leaned on for years.
The second-order read is about the AI threat surface. Aráoz is framing LLM-assisted vulnerability discovery as a step-change in attacker capability — the same tooling that lets a five-person team ship faster also lets a hostile actor find an exploit class that no human auditor covered. Smart contract exploits are not probabilistic losses; they are total-loss events. The asymmetry he is pointing to is between the cost of an audit and the value at risk the audit is meant to protect.
Market impact
Expect the quote to surface in regulatory commentary and insurance underwriting — DeFi cover providers, protocol treasuries, and custody providers will all have to revisit assumptions about what an OpenZeppelin audit actually warrants in pricing. The honest read for users is not "DeFi is over"; it is that the gap between "audited" and "safe" is wider than the marketing suggested, and that gap is widening as AI attackers get cheaper.
Frequently asked questions
-
Who is Manuel Aráoz and why does his DeFi warning carry weight?
Manuel Aráoz is a co-founder of OpenZeppelin, one of the most respected smart contract security firms in crypto. OpenZeppelin's audit clients include Aave, Compound, MakerDAO, Uniswap and Coinbase, so a warning from a co-founder that "all of DeFi is unsafe" comes from inside the audit industry, not from a critic on…
-
What is the AI vulnerability threat Aráoz is pointing to?
Aráoz argues that AI coding agents are reaching superhuman capability in finding smart contract vulnerabilities. The same LLM tooling that helps protocol teams ship faster also lets attackers surface exploit classes faster than human auditors can cover them, widening the gap between "audited" and "safe."
-
Why is smart contract security described as "asymmetric"?
The asymmetry is between the cost of an audit and the value at risk the audit is meant to protect. A protocol may secure tens of millions in TVL, but a single missed bug can drain it entirely — so the downside of an incomplete audit is total, while the upside for the attacker is the full pool.
-
Does this mean audited DeFi protocols are actually unsafe?
Aráoz's framing is that the gap between "audited" and "safe" is wider than the marketing has suggested, and is widening as AI-driven attackers get cheaper. It does not mean every audited protocol is exploitable today, but it argues that audit reports should no longer be read as a clean bill of health.
-
How could this warning affect DeFi insurance and custody pricing?
Expect DeFi insurance underwriters, protocol treasuries and custody providers to revisit what an OpenZeppelin audit actually warrants in pricing. If the audit industry itself is signalling that AI-assisted attackers outpace human reviewers, premiums for cover and risk haircuts on audited positions are likely to rise.
Lookonchain
CryptoSlate
TheBlock
CoinTelegraph
CoinDesk