CryptoSlate
DeFi's total value locked has dropped from roughly $172 billion in mid-April to $148 billion, marking five consecutive weeks of outflows as the sector absorbs a $1.1 billion-plus exploit year capped by a $635 million April alone across 28 reported hacks. The fresh pressure point is AI: on May 27, Manuel Aráoz, co-founder and former CTO of OpenZeppelin, publicly advised investors to exit DeFi positions including Aave, MakerDAO, and Compound, arguing that autonomous coding agents are superhuman at vulnerability discovery while defenders must patch every bug. His warning landed as Bitcoin drifted toward $72,000, amplifying the sense that the sector is fighting on two fronts at once.
Why it matters
The argument cuts deeper than any single protocol failure. a16z research has shown AI agents consistently identifying the core vulnerabilities behind historical DeFi exploits — frequently reaching the reconnaissance stage that gives attackers a head start even when they fail to complete the drain. Anthropic restricted access to its unreleased Claude Mythos model for the same reason. Because DeFi code, governance, and integrations are public and composable, a tool that automates weakness-mapping collapses the expertise bar an attacker needs to clear. Defenders relying on point-in-time audits, bug bounties, and manual review are now defending a perimeter that AI scans continuously.
Market impact
Protocol leadership has pushed back on the doomsday framing — Aave's Stani Kulechov and Uniswap's Hayden Adams both argue that mature DeFi infrastructure is materially stronger this cycle, and that recent large losses (including Drift Protocol's $285M North Korea-linked social engineering hit) trace to operational lapses, not contract flaws. The industry response is converging on AI-versus-AI defense: OpenZeppelin shipped tooling for AI agents to generate contracts from audited libraries, Uniswap launched an AI-integrated developer platform, and Cyvers CEO Deddy Lavid describes the new stack as continuous monitoring, live transaction simulation, and circuit breakers designed to shrink blast radius. Yearn's Banteg disagrees with full exit, but his practical read — stick to older, simpler protocols — is shaping where cautious capital parks next. Complex integrations and exotic yields face the heaviest scrutiny now that AI makes finding weak points cheap.
Frequently asked questions
-
What happened to DeFi TVL in the past month?
Total value locked across DeFi fell from roughly $172 billion in mid-April to $148 billion as of late May, marking five consecutive weeks of outflows against a year-to-date exploit total above $1.1 billion.
-
Why did OpenZeppelin's co-founder tell people to exit DeFi?
Manuel Aráoz argued on May 27 that autonomous AI coding agents are superhuman at finding smart contract vulnerabilities, while defenders must patch every bug — an asymmetry that lets attackers weaponize a single flaw to drain funds.
-
How are AI agents actually being used against DeFi protocols?
According to a16z research, AI agents have consistently identified the core vulnerabilities behind historical DeFi exploits and often reach the reconnaissance stage that gives attackers a starting point, even when they fail to complete the drain.
-
Do DeFi founders agree that the sector is unsafe?
No. Aave's Stani Kulechov and Uniswap's Hayden Adams both argue DeFi infrastructure is materially stronger this cycle, with formal verification, audits, and circuit breakers — and that recent large losses stem from operational lapses rather than contract code.
-
What is the practical response for DeFi users right now?
Yearn Finance developer Banteg advises avoiding new and exotic protocols and focusing on older, more tested systems, while the broader industry is layering in continuous monitoring, live transaction simulation, and circuit breakers to shrink blast radius when failures do occur.
Lookonchain
WuBlockchain
CoinTelegraph
TheBlock
CoinDesk