Flying Tulip adds withdrawal circuit breaker as April DeFi exploits top $600M

Flying Tulip has introduced a circuit breaker to slow or queue withdrawals as DeFi losses mounted in April following a series of large exploits.

According to official documentation, the safeguard is designed to limit how quickly funds can leave the protocol when withdrawal demand exceeds capacity, giving the team time to review unusual activity and contain potential damage. The mechanism steps in during periods of abnormal outflows, capping the pace at which assets can be withdrawn in a worst-case scenario.

Across its products, the system does not behave in the same way. In the Perpetual PUT product, which uses the first version, withdrawal attempts may fail and need to be retried later. 

For its stable asset and settlement currency ftUSD, the second version queues withdrawal requests, allowing users to claim funds after a delay rather than facing outright rejection. A dedicated status page lets users track how the circuit breaker is operating at any given time.

Built with a “fail-open” design, the feature keeps transactions moving even if the safety layer itself malfunctions, while still slowing abnormal outflows instead of blocking them entirely.

Exploits expose weaknesses beyond smart contracts

Industry calls for implementing circuit breaks have been mounting over the past months.

Recent incidents have drawn attention to risks that extend past code vulnerabilities, with operational failures taking center stage. Weaknesses tied to multisig setups, infrastructure configurations, and key management have come under scrutiny as attackers found ways to bypass traditional smart contract defenses.

According to blockchain security firm CertiK, total DeFi losses crossed $600 million within the first few days of April alone.

Two incidents accounted for nearly all of the losses. On April 2, Drift Protocol suffered an exploit estimated at about $280 million. Weeks later, on April 19, the Kelp liquid restaking platform lost roughly $293 million in another attack. Fallout from the Kelp incident prompted Aave to freeze rsETH markets on its V3 and V4 deployments.