Decentralized finance is software on public blockchains that lends, trades and pays without a bank in the middle. Here is how the pieces work, who actually pays the yield, the incidents that cost holders billions, and where US rules stood in November 2026.
Market risk reading, cross‑asset context and an events calendar: see Exent Market intel →
DeFi is financial software that runs on a public blockchain instead of inside a bank or broker. Programs called smart contracts hold users’ crypto and follow fixed rules: swap one token for another, lend tokens to a borrower who posts collateral, or pay out rewards. Anyone with a crypto wallet can usually connect. The US Treasury notes there is no generally accepted definition, and that many services are “decentralized more in name than in fact”: a company, a small group or a few large token holders can often still change the code (US Treasury, April 2023).
Is it safe? Not in the sense a bank account is. DeFi carries code risk, collateral and liquidation risk, stablecoin risk and governance risk, and none of it is covered by FDIC insurance or SIPC. The Financial Stability Board concluded that DeFi performs the same functions as traditional finance and inherits its weak points, operational failures, liquidity mismatches, leverage and interconnection, sometimes in amplified form (FSB, Feb 16, 2023).
Scope: this page explains DeFi for an investor who has seen a DeFi yield offer, as of November 5, 2026. It does not recommend any protocol, coin or platform, quote coin prices or explain how to use a wallet. Stablecoins, the base layer of DeFi, are covered in are stablecoins safe? It is education, not advice.
Five building blocks do most of the work. Each one is also a place where things break:
| Building block | What it does | Main way it fails |
|---|---|---|
| Smart contract | Code that holds deposits and executes the rules automatically | A bug or exploit drains it; upgrade keys get misused |
| Automated market maker (AMM) | A pool of two tokens that sets the swap price from its own balances, so trades need no order book | Pool depositors lose value when prices move (impermanent loss); prices get manipulated in thin pools |
| Lending protocol | Lenders deposit tokens; borrowers post more collateral than they borrow | Collateral falls fast and is sold automatically (liquidation), often at a penalty |
| Stablecoins | Dollar tokens used as the unit of account and the main thing lent and borrowed | The stablecoin breaks its $1 peg |
| Oracles and bridges | Oracles feed outside prices in; bridges move tokens between blockchains | A wrong price triggers bad liquidations; a bridge is hacked |
From three payers, and the third one is the warning sign. Swap fees come from traders using a pool. Interest comes from borrowers, and Bank for International Settlements researchers studying one large lending protocol found that borrowing is mainly for speculation, and partly to gain voting power in the protocol, while deposits are driven by the search for yield (BIS Working Paper 1183, May 2, 2024). So lending yields rise when speculative demand is high and fall when it fades. Token rewards are new coins the protocol prints to attract deposits; their value depends on a price that can drop as fast as it is paid out.
The clearest lesson is TerraUSD. The SEC says its promoters marketed it as a “yield-bearing” stablecoin paying “as much as 20 percent” through the Anchor protocol; in May 2022 it lost its peg and the price of it and its sister tokens fell close to zero (SEC, Feb 16, 2023). For comparison, a Treasury bill ETF such as SGOV showed a 30-day SEC yield of 3.82% on November 3, 2026. A yield far above what short-term government debt pays has to come from someone taking more risk, and in DeFi that is often the depositor.
Leverage is part of the picture. BIS researchers measured the leverage of borrowing wallets on major lending platforms and found it typically between 1.4 and 1.9 times, below the maximum allowed, because borrowers fear automatic liquidation (BIS Working Paper 1171, Mar 13, 2024).
Both use hypothetical round numbers to show the mechanics, not any real protocol. First, impermanent loss in a standard two-token pool, where the pool keeps the product of its two balances constant:
| Step | Just holding | In the pool |
|---|---|---|
| Start: 1 token X at $2,000 plus 2,000 dollar stablecoins | $4,000 | $4,000 (product of balances 1 × 2,000 = 2,000) |
| Token X doubles to $4,000 | 1 × $4,000 + $2,000 = $6,000 | Pool now holds √(2,000 ÷ 4,000) = 0.7071 X and √(2,000 × 4,000) = 2,828 stablecoins |
| Value after the move | $6,000 | 0.7071 × $4,000 + $2,828 = $5,657 |
| Gap before fees | $343, or 5.7% less than holding |
The pool sold token X on the way up. Swap fees earned over the period have to exceed $343 just to match holding; a bigger price move in either direction makes the gap larger. Second, a loan against collateral:
| Step | Figure |
|---|---|
| Deposit token Y worth | $10,000 |
| Borrow dollar stablecoins | $6,000 |
| Hypothetical liquidation threshold | 80% of collateral value |
| Liquidation starts when collateral × 0.80 < $6,000, so below | $7,500 (a 25% fall in token Y) |
| A liquidator repays $3,000 of the debt and takes collateral with a hypothetical 5% bonus | $3,000 × 1.05 = $3,150 of token Y |
| Extra cost to you on top of the price fall | $150 |
The liquidation happens automatically when the price feed crosses the line, including at night or in a brief flash drop, and a wrong oracle price can trigger it too. Real thresholds and penalties differ by protocol and asset.
Each row is a different type of risk, with the official source that documented it:
| When | What happened | Risk type | Source |
|---|---|---|---|
| Reported Mar 29, 2022 | Theft of $620 million in Ethereum from the Ronin bridge; the FBI attributed it to North Korea’s Lazarus Group and APT38 on Apr 14, 2022 | Bridge and key security | FBI |
| May 2022 | TerraUSD, marketed with up to 20% yield through Anchor, lost its peg; the SEC says $40 billion of market value was wiped out nearly overnight | Unbacked yield, algorithmic stablecoin | SEC |
| Mar 10–13, 2023 | USDC, the dollar token used across DeFi, fell to $0.88 when $3.3 billion of its roughly $40 billion of reserves was stuck at Silicon Valley Bank | Stablecoin base layer | New York Fed; Federal Reserve |
| Sept 7, 2023 | The CFTC settled charges against three DeFi operators (Opyn, ZeroEx, Deridex) for offering unregistered, leveraged digital-asset trading; penalties $250,000, $200,000 and $100,000 | Regulatory | CFTC |
| Jun 13, 2024 | Terraform and its founder agreed to pay more than $4.5 billion after a jury found them liable for fraud | Enforcement after the fact | SEC |
| Oct 29, 2026 | About $6.3 billion taken from hot wallets of Binance, a centralized exchange, not a DeFi protocol; the FBI blamed North Korea on Oct 31 and Binance said it would absorb the loss, not its users, and on Nov 3 that it had replenished 98% of the $6.34 billion of affected assets. A reminder that keys and custody are a risk on both sides | Key security at a centralized exchange | CNBC |
The pattern: losses came from code and keys, from yields that were not earned, and from the stablecoins underneath everything. A Federal Reserve staff note found that stablecoin use in DeFi protocols surged in 2025 (FEDS Notes, Apr 8, 2026), so a stablecoin problem now reaches more of DeFi. How a bank failure spread to USDC is told from the bank’s side in why did SVB fail?
Partly, through existing laws rather than a DeFi law. Treasury’s position is that anti-money-laundering duties follow what a service does, and a claim to be “fully decentralized” does not change that. Dated milestones, status as of November 5, 2026:
| Date | What happened | Status |
|---|---|---|
| Apr 2023 | Treasury DeFi risk assessment: obligations depend on activity, not on the “decentralized” label | Government assessment, not a rule |
| Sept 7, 2023 | CFTC orders against three DeFi operators | Settled |
| Apr 10, 2025 | Congress nullified the IRS rule that would have made some DeFi services report users’ sales (Public Law 119-5) | Law |
| May 29 and Aug 5, 2025 | SEC staff statements: covered protocol staking and liquid staking activities are generally not securities offerings, depending on facts | Staff views, no legal force |
| Jul 18, 2025 | GENIUS Act for payment stablecoins signed | Takes effect Jan 18, 2027 |
| Mar 17, 2026 | SEC interpretation, with CFTC guidance, on which crypto assets are securities and on mining, staking, wrapping and airdrops (effective Mar 23, 2026) | In force; does not list lending or trading protocols among its topics |
| Sept 15, 2026 | CLARITY Act (crypto market structure) failed Senate cloture 49–50 | Not law |
| Sept 17, 2026 | SEC exemption lets permissioned venues trade tokenized US stocks through automated liquidity pools | In force; no venue notice found |
| Oct 21, 2026 | OCC final GENIUS rule: no safe harbor for DeFi arrangements that pay stablecoin yield | Effective Jan 18, 2027 |
Sources: CFTC, Congress.gov, SEC and SEC Release 33-11412. The stablecoin law is in the GENIUS Act explained.
Both use blockchains; the difference is who stands behind the token. A tokenized Treasury fund or stock has an issuer, a custodian and a regulator. A DeFi pool usually has code and token-holder votes.
| Typical DeFi protocol | Tokenized real-world asset (e.g. a tokenized money fund) | |
|---|---|---|
| Who you claim against | Recourse depends on identifiable operators, governing terms and applicable law; recovery may be difficult | The fund or note issuer, under its documents |
| Who can join | Anyone with a wallet, often without identity checks | Approved investors after identity checks |
| What backs it | Crypto collateral and stablecoins | Treasury bills, shares or cash held by a custodian |
| Where the return comes from | Swap fees, borrower interest, token rewards | The underlying asset’s interest or dividends, minus fees |
| Main failure mode | Exploit, liquidation cascade, depeg | Issuer, custodian or platform failure |
| Insurance | None | None on the token; fund assets are segregated |
The two are converging: the SEC’s September 2026 exemption allows liquidity pools for tokenized US stocks, but only on permissioned venues with identity checks. The products are covered in what is tokenization? and tokenized Treasury funds.
There is no official count. The usual measure, “total value locked”, is an industry tally that Treasury calls unaudited and liable to double-count. Treasury’s 2023 report cited a reported total of $39.77 billion across more than 2,000 services on December 19, 2022, and BIS researchers noted that lending protocols alone grew from zero to more than $50 billion in under two years. Totals swing with coin prices, so a dated figure mostly measures the crypto market of that day. For how crypto fits in a wider portfolio, see bitcoin in a portfolio.
Counterexample: a retiree is offered 12% on a stablecoin deposit in a DeFi app (a hypothetical offer) and moves $50,000 of emergency cash. The extra income over a Treasury bill fund is paid for with risks that can each wipe out the principal: a contract exploit, a stablecoin depeg or a collateral cascade, with no insurer and potentially limited practical recourse. Money that must be there on a known date belongs in insured deposits or Treasury bills (see where to park large cash). Anyone who does use DeFi can limit the damage by sizing it as money they could lose entirely.
Market intel provides market context, cross-asset analysis, an events calendar and regular written notes. These can inform your review of an existing plan; they do not reliably predict crashes or guarantee better outcomes.
Not as safe as a bank account or Treasury bill. Deposits face smart-contract, liquidation, stablecoin and governance risk, with no FDIC or SIPC coverage. The FBI tied a $620 million bridge theft reported in March 2022 to North Korean hackers, and TerraUSD’s May 2022 collapse wiped out $40 billion of market value, per the SEC.
From traders paying swap fees, borrowers paying interest, or the protocol paying its own newly issued tokens. BIS research on a large lending protocol found borrowing is mainly speculative. If you cannot name who pays, the yield may be a subsidy or compensation for hidden risk.
It carries specific risks: borrowers post collateral that is sold automatically if prices fall, oracles can feed wrong prices, and the contract can be exploited. Lenders depend on liquidations working in a crash. There is no deposit insurance.
The shortfall a trading-pool depositor suffers versus simply holding the two tokens when their relative price moves. In a standard pool, if one token doubles against the other, the pool position is worth about 5.7% less than holding, before fees.
Through existing laws, not a DeFi law. Treasury says anti-money-laundering duties follow the activity; the CFTC settled charges with three DeFi operators on September 7, 2023; the SEC issued a crypto-asset interpretation effective March 23, 2026. The CLARITY Act failed a Senate cloture vote on September 15, 2026.
SEC staff said in May and August 2025 that covered protocol staking and liquid staking activities generally are not securities offerings, depending on the facts, and a Commission interpretation effective March 23, 2026 addressed staking too. Staff statements have no legal force, and other laws still apply.
An industry tally of crypto deposited in DeFi contracts. Treasury calls it unaudited and liable to double-count. Its 2023 report cited a reported $39.77 billion on December 19, 2022; the figure rises and falls with coin prices.
Tokenization puts a claim on a real asset, such as a fund share or Treasury bill, on a blockchain, with an issuer and custodian behind it. DeFi is software that lends and trades crypto tokens, usually with no issuer to claim against.
The token issuer cannot from January 18, 2027 under the GENIUS Act, and the OCC’s October 21, 2026 rule gives DeFi arrangements no safe harbor. Interest paid inside a DeFi lending pool comes from borrowers and carries the pool’s risks.
Market intel provides a Risk ON / Neutral / Risk OFF reading from four pillars, cross-asset analysis, an events calendar and regular written notes. Context for reviewing a plan, not a crash forecast.
Educational content, not investment advice. Examples are illustrative; past performance does not guarantee future results.