Decentralised finance (DeFi) is the name for financial services, such as lending, borrowing, trading and stablecoins, that run as smart contracts on public blockchains instead of through banks or brokers. Anyone with a crypto wallet can use them, and the rules are public code that anyone can read. That code also carries the risk: if it fails, no deposit insurance pays you back. On 25 October 2026, DefiLlama's tracker put the value locked in DeFi at about $88.8 billion. That is roughly half its level a year earlier.
How DeFi works
The Ethereum project's own definition calls DeFi "a collective term for financial products and services that are accessible to anyone who can use Ethereum". The same idea now applies on other smart-contract blockchains too. Three ideas define it:
- Code instead of an institution. "In DeFi, a smart contract replaces the financial institution in the transaction" (ethereum.org).
- Open access. "DeFi is open to anyone." To send or receive payments, "you will need a wallet". You don't need a bank account.
- Public rules. "Contracts are also public for anyone to inspect and audit," and markets run "24/7, 365 days a year".
DeFi transactions are not private. They are recorded on a public ledger, so anyone can trace transfers between wallet addresses.
The four things DeFi replaces
Lending desks
Lending protocols let you earn interest by lending crypto. Borrowers must post collateral, which "the lender will automatically receive if their loan is not repaid" (ethereum.org). A smart contract checks the collateral. No person approves the loan.
Brokers and order matching
On decentralised exchanges, "you trade different tokens whenever you want" (ethereum.org). Trades settle on-chain against a liquidity pool or an on-chain order book. No company's internal ledger is involved.
Settlement within one transaction: flash loans
Flash loans have no equivalent in traditional finance. A flash loan "is taken out and paid back within the same transaction". If it is not repaid, "the transaction reverts as if nothing ever happened" (ethereum.org).
Cash inside the system: stablecoins
Stablecoins are tokens whose value is "pegged to an another asset, usually a popular currency like dollars" (ethereum.org). Most of DeFi's lending and trading uses them as the unit of account.
How big DeFi is now
These figures come from one source, DefiLlama's aggregate total value locked (TVL) across the chains it tracks:
| Date | Total value locked (DefiLlama) |
|---|---|
| 9 November 2021 (record high) | ~$177.5 billion |
| 7 October 2025 | ~$171.0 billion |
| 25 October 2026 | ~$88.8 billion |
TVL depends mostly on the prices of the tokens deposited, and each tracker measures it differently. Read the drop as a fall in the value of deposits, not as a count of users who left.
Have you run the DeFi checks?
Answer six questions taken from the article's checklist to see which risk you have not yet checked before using a DeFi protocol.
Have the protocol's contracts been audited, and are the audits public?
- Yes, audited and public → next question
- No, or I don't know → Code risk not checked
Do you know who controls upgrades and parameters: an admin key, a multisig wallet or a governance-token vote?
- Yes → next question
- No → Control not checked
Will you borrow against collateral on this protocol?
- Yes → next question
- No → next question
Have you read the protocol's liquidation terms?
- Yes → next question
- No → Liquidation terms not read
Will you hold a stablecoin as part of this?
- Yes → next question
- No → Checklist covered
Do you know what backs that stablecoin and who issues it?
Smart contracts, like any software, can have bugs and exploits, and no deposit insurance pays you back if the code fails. The article's first check is whether the contracts have been audited and whether the audits are public.
Strategic decisions are often made by governance-token holders, who are frequently the developers. Find out who can change the contracts and their parameters before you deposit.
If collateral falls in value or a loan is not repaid, the contract hands the collateral to the lender automatically. There is no grace period and no one to call, so read the liquidation terms before you borrow.
Most stablecoins depend on a central issuer that manages reserves off-chain. Check what backs the stablecoin you hold and who issues it.
You have covered the article's checks, but the risks stay: crypto assets are not covered by deposit insurance, and your transfers are visible to anyone on the blockchain.
This walks through the article's checklist only: it cannot judge whether an audit is any good, whether a protocol is safe, or what your tax or legal duties are, and it is not financial advice.
How decentralised is DeFi, really?
Less than the name suggests. In a December 2021 Quarterly Review article, Bank for International Settlements economists Sirio Aramonte, Wenqian Huang and Andreas Schrimpf argued that "full decentralisation in DeFi is illusory". They gave four reasons:
- Strategic decisions are made by holders of governance tokens, who are often the developers.
- Proof-of-stake validation tends to concentrate power among large holders.
- Most stablecoins are run by a central issuer that manages reserves off-chain.
- Users often rely on centralised venues to move money into and out of DeFi.
The authors call these governance points "the natural entry points for policymakers". Regulators have used them since.
The risks
- Code risk. "Ethereum products, like any software, can suffer from bugs and exploits" (ethereum.org). Public code can be audited, but most users rely on others who can read it.
- No deposit insurance. The US Federal Deposit Insurance Corporation says deposit insurance "does not cover non-deposit products, including crypto assets". It also says it "does not insure assets issued by non-bank entities, such as crypto companies" (FDIC FIL-35-2022, 29 July 2022).
- Liquidation. If collateral falls in value or a loan is not repaid, the contract hands the collateral to the lender automatically. There is no grace period and no one to call.
- Stablecoin issuer risk. Most stablecoins depend on a central issuer and its reserves (BIS, 2021).
DeFi moves risk away from banks and onto code, governance and the user. It does not remove it.
The rules in 2026
United States
- Stablecoins: On 18 July 2025 the President signed S. 1582, the GENIUS Act, which regulates payment stablecoins (White House).
- Tax reporting: On 10 April 2025 the President signed H.J.Res.25, a Congressional Review Act resolution. It overturned an IRS rule from December 2024 that would have required DeFi brokers to file Form 1099-DA, the same reporting as securities brokers (House Ways and Means Committee). The resolution also prevents the IRS from issuing a substantially similar rule. Your own tax obligations on DeFi activity remain.
European Union
- MiCA's DeFi gap: The Markets in Crypto-Assets Regulation (EU) 2023/1114 leaves out crypto-asset services provided "in a fully decentralised manner without any intermediary" (recital 22, as cited by legal commentators). Article 142 required the Commission to report by 30 December 2024 on the development of DeFi and on "the necessity and feasibility of regulating decentralised finance" (ESMA interactive single rulebook).
- Review under way: On 20 May 2026 the European Commission opened a targeted consultation on reviewing MiCA, with responses due by 31 August 2026. Its questions include whether crypto-asset service providers should do due diligence on the DeFi protocols they connect clients to, and whether DeFi protocols and smart contracts should have certification schemes (Maples Group summary; the Commission's document itself was not checked).
Anti-money-laundering standards
The Financial Action Task Force's updated guidance of 28 October 2021 says DeFi software itself is not a virtual asset service provider (VASP). But creators, owners and operators who keep control or sufficient influence over a DeFi arrangement may count as VASPs (as summarised by Norton Rose Fulbright and CMS). The guidance is not legally binding. Countries use it as a reference.
Before you use a DeFi protocol
- Check whether the contracts have been audited and whether the audits are public.
- Find out who controls upgrades and parameters: an admin key, a multisig wallet or a governance-token vote.
- Read the liquidation terms before you borrow.
- Check what backs any stablecoin you hold, and who issues it.
- Expect transfers to be visible to anyone on the blockchain.
This article explains how DeFi works. It is not financial, legal or tax advice.
Limitations: the market-size figures come from one tracker (DefiLlama), and the EU consultation details come from law-firm summaries, not the Commission's own text.
