Banks, brokers and exchanges sit in the middle of most financial transactions: they hold the money, keep the records and decide who may take part. Decentralized finance swaps that middle layer for programs running on public blockchains, mostly Ethereum and the layer 2 networks built on top of it. A deposit goes into a smart contract instead of an account, interest rates come from formulas anyone can read, and a trade settles in the same transaction that executes it. That openness has drawn tens of billions of dollars and made DeFi a favorite target for thieves. This guide covers the building blocks, how much money they hold, where yields come from, how a loan gets liquidated, the main risks and where US rules stand. The crypto hub covers the wider market.
What is DeFi?
DeFi, short for decentralized finance, means lending, trading and other financial services that run as smart contracts on public blockchains rather than through banks or brokers.
A smart contract is a program stored on a blockchain that runs exactly as written whenever a transaction calls it; what is Ethereum explains how the network that hosts most of DeFi executes them. Building finance this way has three consequences. Access is open: anyone with a self-custody wallet and a little of the network's token for fees can use a protocol, with no application, credit check or minimum balance. The books are public: every deposit, loan and liquidation is recorded on chain, so anyone can check a protocol's balances at any moment. And the pieces plug into each other: a receipt token from one protocol can be deposited straight into another, which lets developers combine services but also lets one failure spread to the next.
Decentralization is a matter of degree. Many protocols depend on a company or foundation that writes the code, runs the website most people use to reach it and sometimes holds keys that can change settings, upgrade contracts or pause them. Holders of governance tokens vote on changes, but whoever gathers enough tokens can carry a vote, as the governance attack described below shows. For any protocol, the useful questions are who can change the rules and how much notice users get.
How do DeFi lending, exchanges and stablecoins work?
Lending pools match depositors with collateralized borrowers, exchanges swap tokens against pooled liquidity, and stablecoins provide the dollar unit most DeFi activity is priced in.
Lending markets gather deposits into pools and lend them to borrowers who lock up collateral worth more than the loan. There is no credit check because there is no recourse beyond the collateral: when its value falls too far, the protocol lets outside liquidators repay part of the debt and claim collateral at a discount. Rates adjust by formula as more or less of the pool is lent out. One product has no banking equivalent. A flash loan lends any amount with no collateral, provided it is repaid within the same transaction, and if it is not, the whole transaction is undone.
Decentralized exchanges mostly replace the order book with an automated market maker. Liquidity providers deposit pairs of tokens into a pool, a formula sets the price from the ratio between them, and every trade pays a fee to the providers. Uniswap's version 3 pools, for example, charge 0.01%, 0.05%, 0.3% or 1%, with the lower tiers used for pairs that trade close together. Bigger trades shift the ratio further and get worse prices. CEX vs DEX compares this with a centralized exchange, using a $2,000 swap.
Stablecoins are DeFi's working currency. Fiat-backed coins are issued by companies that hold cash and Treasury bills, while crypto-backed coins are minted by protocols against locked collateral that is sold off if its value falls. How stablecoins work explains the designs, and the top stablecoins page tracks their supply.
Other categories sit on top of these three: liquid staking, which stakes ETH and hands back a tradable receipt token; derivatives exchanges; vaults that move deposits between pools; and tokenized Treasury funds. Crypto staking covers where staking rewards come from.
How much money is locked in DeFi?
DefiLlama counted about $85 billion locked in DeFi protocols on November 1, 2026, less than half its record of $177.49 billion on November 9, 2021.
That number, total value locked or TVL, is the dollar value of tokens sitting in protocols' smart contracts. DefiLlama's headline series leaves out borrowed coins, liquid staking, bridges and deposits it would otherwise count twice, such as a receipt token from one protocol parked in another, so it tracks capital at work in DeFi rather than everything held in contracts. Because it is priced in dollars, TVL moves with token prices as well as with deposits. From its second peak of $170.89 billion on October 7, 2025 to November 1, 2026, TVL fell 50%, while ether fell 52%, from about $4,712 to $2,268. The trough after the 2022 crash was $35.99 billion on October 13, 2023, and the low so far in 2026 was $68.07 billion on July 1.
| DefiLlama category, November 2, 2026 | What it covers | Value locked |
|---|---|---|
| Lending | Pools that lend deposits to collateralized borrowers | About $50.6 billion across 660 protocols |
| Decentralized exchanges | Pools that swap tokens at formula prices | About $12.9 billion across 2,157 protocols |
| Collateralized debt positions | Vaults that mint stablecoins against locked crypto | About $7.1 billion |
| Liquid staking, outside the headline | Staked ETH and other coins with tradable receipts | About $51.8 billion |
| Bridges, outside the headline | Contracts holding tokens for use on other chains | About $61 billion |
By network, Ethereum held $44.34 billion, 51.8% of DefiLlama's chain-level total, on November 2, 2026. No other chain had more than $6.2 billion; Base had $5.97 billion, Solana $5.49 billion and Arbitrum $1.45 billion. Activity has spread to cheaper networks, as layer 2 networks explained describes, and moving tokens between them relies on bridges, whose weak points crypto bridges explained sets out.
A large TVL is not a safety rating. Protocols holding billions have been exploited, and deposits attracted by incentive payments can leave as soon as the payments stop.
Where do DeFi yields come from?
DeFi yields come from borrowers paying interest, traders paying swap fees, staking rewards passed through, and token incentives that protocols hand out to attract deposits.
Lending interest is the easiest to trace, because the rate is a formula applied to public numbers. Borrowers pay a rate that rises with utilization, the share of the pool lent out, and depositors receive that interest minus a cut the protocol keeps, called the reserve factor.
Deposit rate ≈ Borrow rate × Utilization × (1 − Reserve factor)
Worked example: Where a 3.85% USDC deposit rate came from
Read from Aave V3's main Ethereum market at block 26,324,796, 04:47 UTC on November 2, 2026:
- Supplied: about 2.35 billion USDC. Borrowed: about 2.20 billion USDC, so utilization was 93.6%
- Borrow rate: 4.48% a year, or 4.58% with compounding
- Reserve factor: 10%
- Deposit rate: 4.48% × 0.936 × 0.90 ≈ 3.77%, which compounds to about 3.85%
- A $10,000 deposit would earn about $385 over a year if that rate held, but it changes with every block as loans are taken and repaid; ten minutes earlier, with utilization at 93.8%, the same pool paid about 3.79% before compounding
The formula explains why DeFi rates swing. When borrowers repay, utilization and the deposit rate fall together. When a pool is nearly fully lent, its rate model makes borrowing sharply more expensive to pull utilization back down, and a pool that is 100% lent has nothing left for depositors to withdraw until loans are repaid or new money arrives.
Swap fees pay the liquidity providers on exchanges, who take on price risk in return. A 50/50 pool keeps rebalancing as prices move, selling the token that is rising for the one that is falling, so if one token doubles against the other, the position is worth about 5.7% less than simply holding both, before fees. That gap is called impermanent loss, and it becomes permanent when the provider withdraws.
Staking rewards reach DeFi through liquid staking tokens, which pass on what Ethereum pays its validators. Token incentives are the least durable source: a protocol pays depositors in its own token, whose price can fall, and the payments stop when the budget runs out. A yield far above what borrowers or traders could plausibly pay usually comes from incentives, or signals that something is wrong. Stablecoin yield vs bank interest sets such rates against insured savings.
How does a DeFi loan get liquidated?
A DeFi loan is liquidated when falling collateral pushes its health factor below 1, letting anyone repay part of the debt and take collateral at a discount.
The health factor compares the collateral's value, discounted by a liquidation threshold, with the debt:
Health factor = Collateral value × Liquidation threshold ÷ Debt
Above 1 the loan is safe; at 1 or below it can be liquidated. Each collateral type has its own settings. On November 2, 2026, Aave V3's main Ethereum market let ETH holders borrow up to 81% of their collateral's value, set the liquidation threshold at 84% and charged a 5% liquidation penalty, paid to the liquidator as a bonus. Under the protocol's current rules, a liquidator may repay half the debt while the health factor is above 0.95, and all of it once the health factor falls to 0.95 or below, or when the collateral or debt is worth less than $2,000.
Worked example: Borrowing 6,000 USDC against 5 ETH
Assumptions: the ETH settings above, ETH at $2,300 when the loan is opened, and interest ignored.
- Collateral: 5 ETH × $2,300 = $11,500, so up to $9,315 could be borrowed at 81%
- Loan: 6,000 USDC, a loan-to-value ratio of 52%
- Health factor: $11,500 × 0.84 ÷ $6,000 = 1.61
- Liquidation price: the health factor reaches 1 when 5 × price × 0.84 = $6,000, at about $1,429, a 38% fall
- ETH drops to $1,400: the health factor is $7,000 × 0.84 ÷ $6,000 = 0.98. A liquidator repays $3,000, half the debt, and takes $3,000 × 1.05 = $3,150 of ETH, which is 2.25 ETH
- Afterward: 2.75 ETH worth $3,850 secures $3,000 of debt, a health factor of 1.08. Equity fell from $1,000 to $850, and the $150 difference is the penalty
- If ETH had instead gapped straight to $1,300: the health factor is 0.91, so the whole $6,000 can be repaid at once for $6,300 of ETH, leaving 0.15 ETH, about $200, out of equity of $500
Three lessons follow. Borrowing the maximum leaves almost no margin: at 81% loan-to-value the health factor starts at 0.84 ÷ 0.81 = 1.04, so a 3.6% fall in ETH is enough to trigger liquidation. Interest makes the debt grow, by about $275 a year on this loan at the 4.58% USDC borrow rate, which slowly drags the health factor down. And liquidation happens automatically, at whatever price the protocol's oracle reports, often in the busiest and most expensive minutes on the network; gas fees explained shows how far fees jumped during one such hour. Adding collateral or repaying part of the loan raises the health factor, but only if it happens before liquidators act. Lending through a company instead of a protocol carries different risks, which crypto lending risks covers through the 2022 failures.
What are the main risks of DeFi?
The main risks are code bugs, manipulated price feeds, governance takeovers, forced liquidations and scams, usually with no insurer to cover the loss.
| Risk | Case | What happened |
|---|---|---|
| Smart-contract bug | Euler Finance, March 13, 2023 | A lending function lacked a health check, so an attacker pushed its own position into insolvency and liquidated itself at a profit; about $197 million was taken, and assets then worth about $240 million were returned after negotiations |
| Oracle manipulation | Mango Markets, October 11, 2022 | The CFTC alleged that a trader drove the thinly traded MNGO token up more than 13-fold in 30 minutes on the exchanges feeding its price oracle, then withdrew over $110 million against the inflated position; about $67 million was later returned |
| Governance attack | Beanstalk, April 17, 2022 | An attacker flash-borrowed more than $1 billion to reach the two-thirds vote needed for emergency execution and passed a proposal sending the protocol's funds to itself in one transaction; Beanstalk put the stolen assets other than its own token at about $77 million |
- Code risk. Audits lower the odds of a bug but do not remove them, and every upgrade adds new code. The Euler flaw came from a function added to fix an earlier, reported bug and went unnoticed for months.
- Oracle risk. A protocol is only as accurate as its price feed. Thin markets, stale prices or a feed that can be moved with borrowed money let attackers borrow against collateral worth far less than the contract believes.
- Governance and admin keys. Whoever controls upgrades can change interest models, collateral rules or the contracts themselves. Long time delays and widely held voting power help; short delays and a few keys concentrate the risk.
- Liquidation and depeg risk. Collateral can be sold at a discount in a fast market, and a stablecoin that slips below $1 can set off liquidations of its own.
- Phishing and approvals. Many losses come from fake websites and malicious token approvals rather than protocol bugs. Crypto scams describes the patterns, and how to store crypto safely covers protecting the keys that sign every transaction.
- No safety net. Tokens deposited in a smart contract are neither bank deposits nor brokerage assets, so FDIC and SIPC protection do not apply and a loss is usually final.
- Price risk. Crypto is volatile and can lose most or all of its value, and ETH, the collateral behind much of DeFi, has more than halved in a year; ETH's price history shows the swings.
How is DeFi regulated in the US?
No single US law governs DeFi: securities, commodities, sanctions and tax rules apply case by case, and the main market-structure bill has stalled.
- Taxes. Swapping one token for another, earning interest and receiving rewards can all be taxable events, whether or not a form arrives. Public Law 119-5, signed April 10, 2025, voided the IRS rule that would have treated DeFi front ends as brokers, so trades made from a self-custody wallet generally come with no Form 1099-DA. Custodial brokers still report: Gross proceeds for sales from January 1, 2025; cost basis for covered assets bought from January 1, 2026 in a custodial account. Form 1099-DA explained covers what they send.
- Securities and commodities. The SEC's March 2026 interpretation, joined by the CFTC, groups crypto assets into five categories: digital commodities, digital collectibles, digital tools, stablecoins and digital securities. Whether a given token or yield arrangement is a security still depends on how it is offered and sold. The CFTC also polices manipulation on DeFi platforms: its Mango Markets complaint was its first oracle-manipulation case.
- Market-structure law. The CLARITY Act, which would split oversight of crypto markets between the SEC and the CFTC, passed the House 294 to 134 on July 17, 2025, but a Senate cloture vote to take it up failed 49 to 50 on September 15, 2026; it had not become law as of November 2, 2026.
- Sanctions. Treasury removed the Tornado Cash mixing protocol from its sanctions list on March 21, 2025, after the Fifth Circuit held in Van Loon v. Department of the Treasury that its immutable smart contracts were not property that could be blocked. Sanctions on people and groups, including North Korean hacking units, still bind anyone who deals with them.
- Stablecoins. The GENIUS Act regulates the issuers of payment stablecoins rather than the protocols that use them: Signed July 18, 2025 (Public Law 119-27); takes effect January 18, 2027. The GENIUS Act guide covers its rules.
For which agency oversees what and how the bills have moved, see US crypto regulation.