The risks of DeFi

DeFi removes the company in the middle. It also removes the people who would catch a mistake or cover a loss. This lesson lists the ways DeFi fails, so you can recognise each one and decide how much to expose.

The code can be wrong

A smart contract does what its code says, including when the code has a flaw. Lesson 7 covered how an attacker who finds one can drain the contract, and how nobody can simply reverse it.

Chainalysis, a blockchain analysis firm, counted more than $3.4 billion stolen from crypto services and wallets in 2025. The single largest theft that year, $1.5 billion, was from a centralised exchange. DeFi services were hit too, though the firm noted that DeFi losses stayed low compared with the amount of money in them.

An audit helps. It is a review by outside specialists, and it finds many flaws. It does not prove there are none.

The price feed can be manipulated

A contract cannot see the outside world. To know that ETH is worth $4,000, a lending service relies on an oracle, a system that brings prices onto the blockchain.

If the oracle can be fooled, so can the service. In October 2022 a trader bought large amounts of one token on the three exchanges that fed the price oracle of a service called Mango Markets. The oracle price rose more than 13-fold in about 30 minutes. He then borrowed against his inflated holdings and withdrew over $110 million. The US Commodity Futures Trading Commission called it oracle manipulation. He later returned about $67 million.

Someone holds the keys

Lesson 41 noted that many contracts can be upgraded by a small group. That power exists so bugs can be fixed. It also means those people, or anyone who steals their keys, could change the rules or move the funds.

Check whether a service's contracts can be changed, who decides and whether there is a delay before changes take effect.

The assets inside can fail

A service can work perfectly and still lose your money, because of what it holds.

• A stablecoin can lose its peg. Lesson 10 covered how.
• A bridged token depends on its bridge. Lesson 33 covered bridge hacks.
• Falling prices trigger liquidations, which push prices lower. Lesson 43 covered the cascade.

Because services are built on each other, one failure reaches places that looked unrelated.

The website can be fake

Many losses involve no bug at all. A copy of a real service's site, a fake link in a search advert or a forged message leads you to sign an approval that hands over your tokens. Lesson 37 covered this in detail.

Nobody will make it right

There is no deposit insurance and usually no legal entity to claim against. Some teams have repaid users after a theft. None is obliged to.

Habits that limit the damage

• Keep amounts small. Treat anything in DeFi as money you could lose entirely.
• Use a separate wallet. Keep savings in a wallet that never connects to DeFi sites.
• Prefer what has lasted. A service that has held large sums for years is a better bet than one launched last month.
• Reach sites from a bookmark. Never from an advert, a message or a search result.
• Read every prompt. If your wallet warns you, stop.
• Revoke approvals you no longer need.
• Spread it out. Do not keep everything in one service or one stablecoin.

High yield and high risk arrive together. Lesson 44 explains why.