Not financial, legal, or tax advice. This guide is for general education only. DeFi is experimental and carries significant risks, including total loss of funds. Do your own research and proceed with caution.

DeFi, short for decentralized finance, is a set of financial services that run on public blockchains instead of through banks or brokers. Using smart contracts, DeFi lets people lend, borrow, trade, and earn yield directly with one another, with software rather than institutions handling the transactions.

Table of Contents

What DeFi is

Traditional finance runs through intermediaries. A bank holds your deposits and decides who can borrow. An exchange matches buyers and sellers. DeFi aims to provide those same functions without the intermediary, using programs on a blockchain that anyone can access.

The building block is the smart contract, a self-executing program that runs on a network like Ethereum. Because these contracts run automatically and are open for anyone to inspect and use, DeFi services tend to be permissionless (open to anyone with a wallet), transparent (activity is visible on-chain), and composable (applications can plug into one another). Most DeFi activity has historically taken place on Ethereum, though other networks host thriving ecosystems too.

Composability is the property that makes DeFi genuinely different rather than just a bank with extra steps, and it is worth dwelling on. Because every protocol is public code that any other protocol can call, they snap together without permission or partnership. You can deposit collateral in one application, borrow against it in a second, and put the borrowed funds to work in a third, in a single transaction, with none of those teams having ever spoken. Developers call it money legos, which sounds twee and describes something with no real precedent in finance, where every integration normally requires lawyers, contracts, and a year.

The catch arrives in the same sentence. Composability means risk snaps together too. When protocols are stacked on one another, a flaw in the bottom one propagates upward through everything built on it, including applications whose developers had no idea it was in the chain. Several of the worst DeFi losses were suffered by protocols that were themselves perfectly well written and simply depended on something that was not.

How DeFi works

The Ethereum Foundation describes DeFi as an open alternative to "every financial service you use today". At the center of DeFi are smart contracts that hold funds and enforce rules. Instead of signing paperwork with a company, you interact directly with a contract from your own wallet. You connect your wallet to an application, approve a transaction, and the contract does the rest, whether that is swapping one token for another, supplying funds to a lending pool, or something more complex.

Because everything is code, the terms are explicit and execute exactly as written. That transparency is a genuine strength, and it comes with a matching weakness: if the code has a flaw, there is no manager to appeal to, and losses can be immediate and permanent.

The step that deserves the most attention is the one that sounds most routine: approving a transaction. When you connect a wallet to a DeFi application, it typically asks permission to spend a token on your behalf, and by default many request unlimited permission that never expires. You are not sending funds at that moment, which is why it feels harmless. You are granting a contract standing authority to take that token from your wallet at any point in the future. If the contract is later compromised, or was malicious from the start, that permission is the door it walks through, and it does not matter how carefully you guard your keys.

The practical habit that follows is to treat approvals as things you grant deliberately and revoke when finished, rather than as a click-through. Most losses that people describe as a hack were, mechanically, an approval the owner signed without reading. Nothing was broken. The system did exactly what it was told.

Staking and earning yield

One of the most common reasons people explore DeFi is to earn a return on assets they already hold.

Staking in the broad sense means committing crypto to help support a network or protocol in exchange for rewards. On proof-of-stake networks, this can mean helping secure the blockchain itself. In DeFi apps, related mechanisms let you supply assets and earn yield. Our guides to how staking works and how it differs from yield farming unpack the distinction.

It is important to understand that advertised yields are not guaranteed and often reflect real risk. High returns can come from token incentives that may not last, or from strategies that can lose money quickly if conditions change.

The word staking is also doing too much work here, and the ambiguity is not accidental. Securing a proof-of-stake network by locking its coin is one thing: the rewards come from the protocol itself, the risk is well understood, and the return is usually a few percent. Depositing tokens into an application that calls the process staking is something else entirely, with a different payer, a different risk, and no relationship to network security whatsoever. Both appear under the same button in the same interfaces. Knowing which one you are doing is the difference between a modest, comprehensible return and an unsecured loan to a protocol you have not read.

Lending and borrowing

DeFi lending platforms let users supply assets to a pool and earn interest, while borrowers take loans from that pool by posting collateral. There is no credit check. Instead, loans are typically over-collateralized, meaning you must lock up more value than you borrow. If the value of your collateral falls below a threshold, the protocol can automatically sell it to repay the loan, a process called liquidation. This design lets strangers lend to one another safely through code, though it exposes borrowers to the risk of losing collateral during sharp price moves.

The obvious question is why anyone would post 150 dollars to borrow 100. The answer is that these are not loans in the ordinary sense of needing money you do not have. They are ways to get liquidity without selling: you keep exposure to an asset you expect to appreciate, unlock cash from it, and in most jurisdictions avoid triggering a taxable disposal in the process. That is the actual use case, and it is why over-collateralization is a feature rather than an obstacle. It also means DeFi lending does almost nothing for the people who most need credit, which is worth noting whenever it is described as banking the unbanked.

Liquidation is where it turns unpleasant, and it does not wait for you. If your collateral falls through the threshold, bots sell it within seconds, at whatever price the market offers, and charge a penalty for the privilege. The cruel arithmetic is that this happens during exactly the sharp drops when everyone is liquidated at once, so the forced selling pushes prices lower and triggers more liquidations. Cascades like this have wiped out billions in an afternoon. Borrowing against volatile collateral is a leveraged position however calmly the interface presents it.

Decentralized exchanges

A decentralized exchange, or DEX, lets you trade one token for another directly from your wallet, without handing custody to a company. Many DEXs use liquidity pools, where users deposit pairs of tokens that others can trade against, and those depositors earn a share of the trading fees. A decentralized exchange is a core piece of DeFi because it lets value move freely between tokens without a central operator, and the liquidity pools behind it are what make the trades possible.

Where the yield actually comes from

This is the question that separates people who do well in DeFi from people who fund them. Any yield is someone paying you, and there are only a few possible someones.

  • Borrowers paying interest. The most legible source. You supply an asset, someone borrows it and pays for the privilege, and you take a share. Rates are modest and move with demand, which is what a real return usually looks like.
  • Traders paying fees. You supply assets to a liquidity pool and earn a cut of every swap against it. Also real, and quietly offset by impermanent loss, which is the gap between what your deposit is worth in the pool and what it would have been worth if you had simply held the two assets.
  • The protocol printing its own token. Enormously common, and not a return in any meaningful sense. The protocol pays you in a token it created from nothing to attract deposits. Advertised as an APR, funded by dilution, and it lasts precisely as long as new buyers do.
  • Someone else's losses. Some strategies pay well because you are taking the other side of a risk that has not shown up yet. The yield is the premium; the event is still coming.

The third category is where most eye-catching numbers come from, and it explains the shape of nearly every DeFi cycle. A protocol offers a spectacular yield in its own token, capital floods in chasing it, the token's price falls under the weight of everything being emitted and sold, the yield collapses, and the capital leaves for the next one. Nobody was defrauded. The return was an accounting artifact from the start.

So the useful test before depositing anything is simply: who is paying me, in what, and why would they stop? If the answer is a borrower paying interest in a real asset, that is a business. If it is a protocol emitting a token it invented, that is a marketing budget, and you are the one being marketed to. Our guide to staking versus yield farming works through where each one sits.

Risks to understand

  • Smart contract risk. Bugs and exploits can drain funds instantly, and DeFi has seen many large hacks.
  • Volatility and liquidation. Collateralized positions can be liquidated quickly during sharp price swings.
  • Scams and rug pulls. Some projects are designed to steal deposits. Anonymous teams and unaudited code are red flags.
  • Complexity. DeFi assumes a fair amount of knowledge, and mistakes are easy to make and hard to reverse.
  • Regulatory uncertainty. The legal status of many DeFi activities is still developing.
  • Oracle risk. Protocols need to know prices, and they learn them from feeds called oracles. Manipulate the feed and you can convince a lending protocol that worthless collateral is valuable, which is exactly how a number of large exploits worked.
  • Governance and admin keys. Many protocols retain an upgrade key or an emergency switch. Whoever holds it can, in principle, change the rules under your position. Decentralized is a spectrum here too.

It is worth sitting with the scale of the smart contract risk rather than nodding past it. Billions of dollars have been stolen from DeFi protocols, and the pattern is consistent: audited code, competent teams, and a flaw nobody spotted until someone did, at which point the funds left in a single transaction and were gone. There is no insurance by default, no regulator to complain to, and no realistic prospect of recovery. Traditional finance is slow and paternalistic partly because it has spent a century learning what happens otherwise.

Because of these risks, many experienced users treat DeFi as an advanced area and commit only what they can afford to lose. The basic security checklist applies here more than anywhere.

Common misconceptions

"DeFi is a savings account with better rates." A savings account is insured and boring. Supplying to a lending protocol is an uninsured loan to an anonymous pool, executed by code that can be exploited. The rate is higher because the risk is higher, not because banks are greedy.

"It is decentralized, so nobody can take my money." Nobody can freeze it. Plenty of people can take it, if the contract has a flaw, the oracle can be manipulated, or you approve the wrong transaction.

"Audited means safe." Most large DeFi exploits hit audited protocols. An audit reduces the odds of a known class of bug and certifies nothing about the economics or the version running next month.

"High APY means the protocol is doing well." Often the reverse. Extreme yields usually mean a protocol is paying heavily in its own token to rent deposits it cannot attract otherwise.

"Impermanent loss is temporary, it says so in the name." The name is misleading. It only reverses if prices return to where they started. Withdraw before that and the loss is entirely permanent.

"DeFi has no middlemen, so it is cheaper." It has different middlemen: gas fees, liquidity providers taking a spread, and bots reordering transactions to extract value from yours. The costs are real and mostly invisible.

How to get started

Build a solid base first, since DeFi assumes you are comfortable with crypto fundamentals, Ethereum and self-custody wallets alike. If you choose to explore, start with well-established, widely audited applications, use small amounts while you learn, and be skeptical of unusually high advertised returns. Understanding a protocol before you deposit is the single best protection you have.