What Is DeFi? Decentralised Finance Explained (With the Risks)

Banks, brokers and exchanges all do the same basic job: they hold your money, match you with someone on the other side, and keep the records. DeFi tries to do that job with software that anyone can inspect and nobody can close for the weekend. The idea is simple. The details, and especially the ways it breaks, are where most explainers go quiet. This guide covers what DeFi means, how it works, what you can actually do with it (DEXs, liquidity pools, lending, stablecoins, yield farming), where the money for “yield” really comes from, and the specific risks, with real incidents from 2025 and 2026.

What is DeFi?

DeFi, short for decentralised (or decentralized) finance, is the name for financial apps built on public blockchains where smart contracts, not a company, hold the funds and carry out the transactions. ethereum.org describes it as “a collective term for financial products and services that are accessible to anyone who can use Ethereum.”

Three features separate DeFi from a normal finance app:

• Self-custody. You use your own wallet. The app never takes your assets into a company account; you approve a smart contract to move specific tokens.
• Open access. Anyone with a wallet can use the contracts. There is no account application, though many website front ends block some countries.
• Public code and records. The contracts and every transaction are visible on the blockchain.

What DeFi does not mean: that nobody is in charge. A 2021 Bank for International Settlements study put it bluntly: “all DeFi platforms have an element of centralisation, which typically revolves around holders of ‘governance tokens’.” Teams and token holders can usually change parameters, upgrade contracts or pause markets. Knowing who holds those powers is part of understanding any DeFi app.

Is DeFi the same as crypto?

No. Crypto is the broad category of blockchain tokens, including Bitcoin and Ether. DeFi is one use of those tokens: financial services run by smart contracts. Buying bitcoin on a centralised exchange is crypto but not DeFi, because the exchange holds your coins. Swapping tokens on Uniswap from your own wallet is DeFi.

How does DeFi work?

A blockchain is a shared ledger that thousands of computers keep in sync, so no single party controls the record. Some blockchains, Ethereum being the largest, can also run programs called smart contracts. A smart contract can hold tokens and release them only when its coded conditions are met.

ethereum.org breaks DeFi into four layers:

1. The blockchain, which records who owns what (Ethereum, Base, Solana, BNB Chain and others).
2. The assets: ETH and the other tokens, including stablecoins.
3. The protocols: smart contracts that provide a service, such as a lending market or an exchange.
4. The applications: the websites and wallets you click through, which send transactions to the protocols.

Each step you take is a blockchain transaction that you sign with your wallet and pay a network fee (“gas”) for. Because protocols are open, one can plug into another. A token you receive from one protocol can be deposited as collateral in a second and traded in a third. That stacking is called composability. It is DeFi’s main strength, and, as the risk section shows, the way one failure spreads to many apps.

Where DeFi activity sits today

According to DefiLlama, total value locked (TVL, the value of assets deposited in DeFi contracts) was about $91.4 billion on 13 October 2026. These figures are a snapshot. They move with token prices every day and are not a measure of safety.

Source: DefiLlama dashboards for TVL, chains, DEX volume and stablecoins (checked 13 October 2026). Some ranking explainers still quote early-2026 figures, such as Aave at about $27 billion and Ethereum at 63% to 68% of DeFi TVL; both are well above the October 2026 snapshot.

For scale, the EU’s banking and markets authorities, the EBA and ESMA, called DeFi “a niche phenomenon” in January 2025, with value locked in DeFi at about 4% of the global crypto-asset market.

What can you do with DeFi?

What is a DEX?

A decentralised exchange (DEX) lets you swap one token for another straight from your wallet. There is no account and no company holding your funds between trades. Most DEXs, including Uniswap, PancakeSwap, Aerodrome and Curve, do not use an order book of buyers and sellers. They use liquidity pools.

What is a liquidity pool, and how do AMMs work?

A liquidity pool is a smart contract holding two (or more) tokens, for example ETH and USDC. Traders swap against the pool rather than against another person. The rule that sets the price is called an automated market maker (AMM).

Uniswap’s documentation describes the classic version as “x * y = k”: the amounts of the two tokens, multiplied together, must stay constant during a trade. If you take ETH out of the pool, you must put in enough USDC that the product does not fall. The more ETH you take, the more each extra unit costs, which is why large trades in small pools get worse prices (called slippage).

The pool’s price only changes when someone trades. If it drifts from the price on other markets, arbitrage traders buy the cheap side and sell the expensive side until the gap closes. That is how a pool “knows” the market price.

The tokens in the pool come from liquidity providers. Anyone can deposit both tokens and receive a pool token representing their share. In Uniswap v2, each trade pays a 0.30% fee that is added to the pool, so providers collect it when they withdraw. Newer designs, such as Uniswap v3 and v4, let providers choose price ranges and fee tiers, which changes the maths below.

What is impermanent loss?

Impermanent loss is the shortfall a liquidity provider has compared with simply holding the two tokens, caused by the pool rebalancing as prices move. Several of the ranking pages mention it in one line. Here is how it works, with hypothetical prices and fees ignored:

1. You deposit 1 ETH and 2,000 USDC into an x * y = k pool when ETH is $2,000. Your stake is worth $4,000.
2. ETH rises to $4,000 elsewhere. Arbitrage traders buy ETH from the pool until its price matches. To keep x * y constant, your share ends up as about 0.707 ETH and 2,828 USDC.
3. Your pool share is now worth about $5,657. If you had held the original 1 ETH and 2,000 USDC, you would have $6,000.
4. The $343 gap, about 5.7%, is impermanent loss. It shrinks if the price returns to where you started, and becomes permanent if you withdraw at the new price.

Fees earned can offset it, or not. Whether they do depends on trading volume, which is not predictable from a pool’s past numbers.

What is DeFi lending, and how does it work?

DeFi lending runs on pooled markets such as Aave, Morpho, Compound and Spark. Lenders deposit tokens into a pool. Borrowers take tokens out by locking up collateral worth more than the loan. Aave’s documentation states that “positions are always over-collateralized, meaning the collateral value must exceed the borrowed amount.” No credit check is involved because the collateral is the only guarantee.

Interest rates are set by code, not a loan officer. On Aave, “interest rates adjust with utilization”: the more of a pool that is borrowed, the higher the rate, rising steeply once usage passes a set level. That is why any lending rate you see is a snapshot that can change block by block.

The key risk mechanism is liquidation. Aave measures each loan with a health factor, which its help centre defines as total collateral value multiplied by the collateral’s liquidation threshold, divided by total borrowed value. Below 1, a liquidator can repay part of your debt and take some of your collateral at a discount (the “liquidation bonus”). A worked example with hypothetical numbers:

• You deposit ETH worth $10,000 as collateral. Assume its liquidation threshold is 80%.
• You borrow $6,000 of USDC. Health factor: (10,000 x 0.80) / 6,000 = 1.33.
• ETH falls 25%, so your collateral is worth $7,500. Health factor: (7,500 x 0.80) / 6,000 = 1.0.
• Any further fall makes the position liquidatable, and you lose part of your collateral plus the bonus paid to the liquidator.

Prices come from oracles, outside data feeds that tell the contract what ETH is worth. If the oracle is wrong or manipulated, healthy loans can be liquidated, or bad loans approved.

Flash loans are a DeFi-only variant: borrowing with no collateral, provided the loan is repaid within the same transaction. If it is not repaid, ethereum.org explains, “the transaction reverts as if nothing ever happened.” They are used for arbitrage and refinancing, and are also a common tool in exploits, as in the Cetus case below.

Is DeFi lending risky?

Yes, for both sides. Borrowers face liquidation when collateral prices fall or oracles misfire. Lenders face smart contract bugs, bad debt if liquidations fail to cover a loan, and the risk that they cannot withdraw because a pool is fully borrowed. That last point surprises many lenders: when utilisation hits 100%, there is nothing left in the pool to pay you until borrowers repay or new deposits arrive. It happened at Aave in April 2026 (see the KelpDAO case below). None of this is covered by deposit insurance.

Stablecoins: DeFi’s unit of account

Most DeFi trading and lending is priced in stablecoins, tokens built to hold a steady value, usually $1. They let you stay in a dollar value without leaving the blockchain. They also carry their own risks: reserve quality, redemption access and depegs. The site’s guide What Is a Stablecoin? covers the four types and the depegs that have happened.

What is yield farming?

Yield farming means depositing tokens into DeFi protocols, often moving them between several, to collect whatever those protocols pay out. It is not a product in itself; it is a strategy built on the services above. Any return has to come from somewhere, and in DeFi there are four main sources:

An advertised APY is a snapshot of these flows at one moment, often annualised from a short period. It is not a rate anyone guarantees, and stacking several protocols to raise it also stacks their risks. If a return cannot be traced to one of these sources, treat that as a red flag.

US regulators are watching this area too. In a 22 July 2026 statement, SEC Commissioner Hester Peirce noted that vaults which “hold or allocate assets to securities could fall into investment company territory,” according to the DeFi Education Fund’s summary.

DeFi vs traditional finance and centralised exchanges

DeFi swaps the risk of trusting a company for the risk of trusting code and yourself. Exchange risk is real too: DefiLlama’s hacks list records a $387 million hot wallet compromise at Bitget on 24 September 2026. The Exchanges section covers the centralised side.

The risks of DeFi, with real examples

The ranking explainers list risks in general terms. Each risk below is tied to the part of DeFi it comes from and to a documented incident, so you can see how it actually plays out.

DefiLlama’s hacks database puts the total value stolen in DeFi at $9.28 billion, and from bridges at $3.69 billion, out of $21.07 billion across all of crypto (checked 13 October 2026).

1. Smart contract bugs, even in audited code

On 22 May 2025, Cetus, the largest DEX on the Sui blockchain, lost $223 million. According to Rekt’s write-up, a maths flaw in a shared library let an attacker, using a flash loan, add a tiny deposit that the pool counted as enormous liquidity, then withdraw real tokens against it. Sui validators froze about $162 million; over $60 million had already been bridged out. Cetus had been audited several times. The auditor Zellic said the vulnerable library was outside its audit scope. An audit proves what was checked, on what date, not that a protocol is safe.

2. Composability: one failure spreads

On 18 April 2026, an attacker forged a cross-chain message to KelpDAO’s rsETH bridge and minted about 116,500 rsETH, roughly $290 million. The bridge relied on a single verifier, a setup a risk firm had flagged in February 2025. The attacker then deposited the rsETH as collateral on Aave and borrowed ETH against it. Rekt’s analysis reports WETH pools hitting 100% utilisation, blocking withdrawals, billions leaving Aave within 48 hours, nine protocols freezing markets and estimated Aave bad debt of $124 million to $230 million. Lenders who had never touched rsETH were affected. That is composability working in reverse.

3. Bridges

Bridges move tokens between blockchains, usually by locking them on one chain and issuing a copy on another. If the bridge is fooled, the copies are worthless. Bridge incidents fill the top of Rekt’s all-time leaderboard: Ronin ($624 million, March 2022), Poly Network ($611 million, August 2021) and BNB Bridge ($586 million, October 2022). DefiLlama also lists bridge logic flaws at NEAR Intents ($3.8 million) on 1 October 2026 and Payy Network ($1.83 million) on 24 September 2026.

4. Oracle manipulation

If a protocol trusts a price that an attacker can move, the attacker can borrow too much or trigger liquidations. DefiLlama classifies the 10 October 2026 Papertrade loss of $1.28 million on Hyperliquid as spot price oracle manipulation.

5. Scams, fake sites and approvals

Many losses never touch a protocol’s code. DefiLlama lists a “Fake GIWA Bridge” impersonation scam that took $2.08 million on 27 September 2026, and a token approval abuse at Limit Break Payment Processor ($1.8 million, 24 September 2026). When you approve a contract to spend your tokens, that permission can stay open until you revoke it. Rug pulls, where a team drains its own project, are the other common pattern.

6. Admin keys and governance

ethereum.org says no one can alter a smart contract once it is live. That is true of the code at one address, but many protocols use upgradeable contracts or admin roles that can change parameters, pause markets or swap the code behind the same address. The KelpDAO case also showed chain-level powers: Arbitrum’s Security Council froze about 30,766 ETH of the attacker’s funds. That helped victims, and it also shows that “decentralised” systems contain people with the power to intervene.

7. Liquidation, volatility and your own keys

Borrowers can be liquidated in minutes during a crash. Liquidity providers face impermanent loss. And because you hold your own keys, losing your recovery words, or typing them into a phishing site, means losing the wallet with no one to call. The site’s guide to seed phrases covers how to store them.

Is DeFi safe?

No DeFi protocol can be called safe, and that includes audited and large ones. Some questions narrow the risk: Has the code been audited, by whom, and what was in scope? Is there a bug bounty? Has the protocol been exploited before, and how did it respond? Who can upgrade or pause the contracts? Which oracle does it use? Does it depend on a bridge or a token from another protocol? How much of the pool is borrowed right now? None of the answers makes a protocol safe, but a protocol that cannot answer them is a clear warning sign.

Is DeFi regulated?

Partly, and the rules are still moving. The protocols themselves are mostly outside existing licensing regimes, while the companies around them (front ends, stablecoin issuers, exchanges) often are.

For you, the practical point is that a DeFi protocol gives you none of the protections of a regulated provider: no ombudsman, no compensation scheme, no deposit insurance. Rules on tax and reporting still apply to you as a user in most countries, so check your local tax authority’s guidance.

How do you get your money out of DeFi?

Getting from DeFi back to a bank account usually takes three steps:

1. Exit the protocol. Withdraw your deposit, repay any loan, or remove your liquidity, so the tokens are back in your wallet. This can fail if a lending pool is fully borrowed or a market is paused.
2. Move to an off-ramp. Self-custody wallets cannot pay a bank directly. Send the tokens, usually as a stablecoin, to a centralised exchange or payment service that supports withdrawals in your currency. Check that you use the network the exchange supports for that token.
3. Sell and withdraw. Sell for your local currency and withdraw to your bank. The exchange will need identity checks, and the sale may be a taxable event where you live.

Some wallet apps build in an off-ramp partner, which does the same steps behind one screen.

What this means for you

DeFi is a working alternative way to trade, lend and borrow, with real benefits: it is open all hours, you keep custody, and every rule is public. The cost is that you take on the jobs a bank or exchange would do for you, including security, checking counterparties and absorbing losses. Before using any protocol, check where its yield comes from, who can change its contracts, what it depends on (oracles, bridges, other tokens), its audit scope and incident history, and how you would exit in a crisis. Treat every figure here as a dated snapshot, and recheck it on the source before relying on it.

For how this site researches and dates its claims, read the methodology, and find more plain-English explainers in Guides.