DeFi explained: how it works and where the risks lie

“No intermediaries”, “open to everyone”, “the code is public”. Decentralised finance (DeFi) tends to be pitched in phrases like these, and some of them are true. Others need qualifying. Let’s get specific: what DeFi is, how it works under the hood, and where things go wrong.

If the basics aren’t clear yet, meaning what a blockchain is and how transactions are recorded, start with the beginner’s guide to blockchain and cryptocurrencies. Here we take that as known.

What DeFi is

According to ethereum.org, DeFi is a collective term for financial products and services that are accessible to anyone who can use Ethereum, which means anyone with an internet connection. Markets are always open, and there is no central authority that can block payments or deny access. The services are run by code (smart contracts) that anyone can inspect.

That is the promise as it is usually told. The awkward version is this: the code being public does not mean anyone has read it carefully, nor that whoever controls it cannot change it. We come back to that below.

How it works

A DeFi protocol is, in essence, a set of smart contracts deployed on a blockchain. You interact with them from your wallet, without opening an account or going through an institution that approves the transaction. The contract receives your funds, applies rules written in advance and gives something back in return.

The most common categories, with the largest protocols by total value locked (TVL) listed by DefiLlama as of 28 October 2026:

Lending. You deposit assets so that others can borrow them, or you borrow by leaving other assets as collateral. Aave (17.356 billion USD of TVL) and Morpho (11.374 billion) are the examples on the list.
Liquid staking. Staking means locking up crypto-assets to take part in validating a network. In its liquid form, you receive a token that represents that position and that you can keep using. Lido, with 22.29 billion USD, tops the ranking.
Decentralised exchanges (DEXs). Trading platforms where tokens are swapped directly against contracts, without the platform holding your funds in custody. DefiLlama puts their volume at 6.851 billion USD over 24 hours and 41.579 billion over seven days, equal to 22.06% of the volume of centralised exchanges.
Stablecoins. Tokens that aim to hold a stable value, normally that of the dollar. Their combined market capitalisation was 297.94 billion USD, with Tether (USDT) at 60.69%.

What TVL tells you and what it doesn’t

TVL is the amount of assets deposited in protocols. As of 28 October 2026, DefiLlama put it at 87.573 billion USD, after a 3.8% fall over the week, with Ethereum leading the decline (4.3 billion USD less). The page lists 6,890 protocols.

It should be read with care. It measures money deposited, not money earned and not money that is safe. It also moves with the prices of the deposited assets, so a fall can be funds leaving or simply prices moving. And the fact that the data is open is an enormous advantage that almost nobody uses: it is there for anyone who wants to check it.

What is being paid for

If a protocol offers you a return for depositing, the awkward question is who pays it. In practice there are only a few answers: a borrower who pays interest, fees from the people using the service (for example, those swapping on a DEX), or new tokens issued by the protocol itself. The first two have an identifiable source. The third depends on the token continuing to interest someone. If you don’t know where the yield comes from, you are the yield.

Risks

Smart contract. A flaw in the code can drain a protocol. Rekt’s leaderboard lists protocols that have been attacked and warns that the list is not complete and never will be. Several entries are listed as unaudited; among the recent ones, Moonwell (1,780,000 USD, 15 February 2026) and Abracadabra (1,800,000 USD, 4 October 2025). An audit reduces risk, it does not remove it, and “audited” is not the same as “safe”. When the risk depends on how the contract is written, code analysis is Dex’s territory.
Governance. Whoever controls the decisions controls the rules. According to DefiLlama, an attacker took control of Hifi Finance’s governance and minted 25 million HIFI. “Decentralised” is a spectrum: always ask who can change the rules.
Cross-chain bridges. Poly Network lost around 611 million USD in August 2021, in a theft that affected Ethereum, BSC and Polygon; Rekt called it the biggest crypto hack up to that point. The Nomad bridge lost 190 million USD in an attack lasting about two and a half hours, and Rekt stresses that it was “permissionless”: anyone could join in. According to Rekt, bridges are a recurring weak point and, when they fail, they often collapse completely. More recently, DefiLlama mentions that zkLink Nova lost around 783,000 USD.
Regulation. There is a gap here and a review under way, which we set out below.
Opaque data. ESMA points out that data gaps make it harder for regulators and investors to understand DeFi and its risks.

DeFi and European regulation

The European Securities and Markets Authority (ESMA) explained in 2023 that the EU regulatory framework, including the MiCA regulation, is built around regulating intermediaries or central authorities, which is exactly what DeFi aims to remove. MiCA sets up a framework for crypto-assets that were previously unregulated, but it does not address DeFi directly: its recital 22 leaves out services provided in a fully decentralised manner. ESMA considered at the time that the phenomenon remained small, but that it posed risks to investor protection and possibly to financial stability.

On 30 September 2026, ESMA responded to the European Commission’s consultation on the review of MiCA. Among its recommendations: clearer criteria for determining which activities are genuinely decentralised, a new regulated service for firms that give users access to DeFi protocols, and rules to stop regulated crypto firms from offering services linked to stablecoins that do not comply with MiCA. These are recommendations, not approved rules.

For the wider context, the article on blockchain and web 3.0 looks at where this ecosystem comes from.

What to look at before you trust it

These are not recommendations, but questions:

Where does the yield the protocol promises come from, and who pays it?
Who can modify the contracts or mint tokens? Is there a single admin key, or a real governance process?
Which audits exist, from what date, and what did they cover? Have the contracts changed since?
Does it depend on a cross-chain bridge or another component whose failure would drag down the rest?
What does the public data, for example on DefiLlama, say about how deposited funds have changed over time?
What legal protection would you have if something goes wrong, given that MiCA does not cover anything fully decentralised?

If you want to move on to the practical side of using a wallet with these applications, ask Luk, who covers the tools step by step.

Closing

DeFi works: there are billions deposited and contracts that run without anyone’s permission. That does not make it safe or free. What it offers is transparency, and what it asks is that you use it.

Sources

Image: geralt on Pixabay

Translated and adapted by Ollie.

DeFi explained: what decentralised finance is, how it works and where the risks lie