Is All DeFi Unsafe? Industry Leaders Push Back After Openzeppelin Founder Warns Retail to Exit Blue-Chips

Shifting From Drama to Data

When Openzeppelin co-founder and former Chief Technology Officer (CTO) Manuel Aráoz characterized decentralized finance ( DeFi) as entirely unsafe, it rattled an industry already reeling from a spike in hacks. Highlighting that vulnerability, a recent analysis by blockchain security firm Peckshield found that cross-chain protocol exploits alone drained $328.6 million between the start of the year and mid-May.

Aráoz’s viral warnings forced Openzeppelin to publicly distance itself from some of his claims, but the remarks succeeded in sparking a fierce debate over DeFi security. Still, critics dismissed his dramatic language as a self-serving attempt to stir fear and panic. Others, like Leo Fan, founder of Cysic, believe the framing undermines the credibility of a message that has a real core.

“Wrapping it in ‘exit everything’ turns a needed warning into doomer content,” Fan said. “You don’t need drama to move people in this space; you need a number.”

The same sentiment is echoed by Michael Heinrich, co-founder and CEO of 0G Labs, who points to the approximately 98% improvement in DeFi lending security from its 2020 baseline. Heinrich also highlights the markedly reduced daily loss rates on major lending protocols, now around 0.001%, as another factor that undercuts Aráoz’s “all DeFi is unsafe” comments.

“Telling retail to exit blue-chips like Aave and Maker doesn’t match the actual risk-adjusted picture,” Heinrich told Bitcoin.com News.

In making the argument against DeFi, Aráoz insisted that artificial intelligence (AI) coding agents have become incredibly advanced at scanning open-source smart contracts and identifying complex exploitable flaws at machine speed. The threat posed by these agents is so great that he has privately advised his friends and family to completely exit their positions in major, long-established “blue-chip” DeFi protocols.

The Death of the Static Audit

However, Heinrich and Fan argue that the rise of superhuman AI attackers does not mean defenders should abandon ship. Instead, they say it requires a fundamental shift in how the industry approaches security.

“The point-in-time audit is already dead; people just haven’t held the funeral,” Fan said. He warned that shifting entirely from audits to bug bounties is the wrong lesson. “You don’t replace prevention with monitoring — you collapse the gap between them.”

According to Heinrich, relying on an annual audit is no longer a credible defense. Instead, the future of smart contract security relies on a machine-speed, layered defense pipeline where audits serve as the first checkpoint rather than a single event. He outlined a four-layer security stack: pre-deployment AI-assisted audits paired with human review, continuous post-deployment monitoring, well-funded bug bounties, and verifiable AI on the defender side.

The ultimate goal, Heinrich noted, is incorporating formal verification on critical paths—using mathematical proofs rather than subjective reviews—alongside continuous AI-augmented reviews running against live contracts the same way attackers operate.

“Audits don’t go away,” he said. “They become the first checkpoint in a machine-speed defense pipeline.”

Beyond preventative security pipelines, the conversation around risk mitigation inevitably turns to insurance, a primitive that Heinrich notes remains severely underdeveloped in the crypto ecosystem. According to Heinrich, a few structural hurdles keep the decentralized insurance sector constrained. First, insurance pools lock up capital that could otherwise earn active yield elsewhere in DeFi.

To illustrate this point, Heinrich points to market leader Nexus Mutual, which holds approximately $190 million against a broader DeFi market that fluctuated between $40 billion and over $100 billion in total value locked. Heinrich notes that this capital ratio is structurally thin. Another hurdle is defining what constitutes an on-chain exploit, which he describes as a non-trivial exercise.

Despite these hurdles, Heinrich argues that enforcing insurance mandates across protocols is the wrong tool to drive adoption. Instead, the industry must innovate at the product level.

“What actually moves the needle are parametric on-chain products that pay out automatically on verifiable signals, and protocols that bundle insurance into the product the way clearing fees work in traditional markets,” Heinrich said.

Regulating Operations, Not Just Code

While the current safety net is narrow, market demand is accelerating. According to a March 2026 forecast by Coinlaw, the decentralized insurance market is projected to grow nearly fivefold by 2029.

“The capital is coming,” Heinrich noted. “What’s missing is the product surface to deploy it.”

The industry’s internal shift toward machine-speed defense and automated safety nets raises broader questions about regulatory oversight. As policymakers increasingly scrutinize digital asset security, Fan cautions that regulators risk hyper-focusing on the wrong threats, such as the specter of rogue AI systems.

“The smarter regulatory instinct isn’t to panic about AI attackers specifically,” Fan said. “It’s to focus on the operational layer where the money actually leaves: key custody, multisig governance, bridge security, and incident response.”

Fan argues that by enforcing strict operational security standards on these specific vectors, oversight bodies could eliminate the vast majority of real-world capital losses. Focusing exclusively on smart-contract code while neglecting day-to-day operations, he warned, amounts to “regulating the 10% and missing the 90%.”

Furthermore, Fan pointed out a technical primitive that policymakers consistently undervalue: advanced cryptography.

“Cryptographic proof, like zero-knowledge proofs, of what code ran and that it ran correctly is a far better compliance primitive than a PDF audit report,” Fan said. “It is auditable by math, not by trust. That’s where I’d want regulatory energy going.”