InfoCrypto

What Is DeFi? Decentralised Finance Explained

DeFi rebuilds lending, trading and derivatives as public software. That removes the intermediary and replaces it with code that cannot be appealed to.

Last reviewed: Written and checked by the InfoCrypto editorial team

Key points

  • DeFi replaces financial intermediaries with smart contracts anyone can inspect and use.
  • The core primitives are lending pools, automated market makers and stablecoins.
  • Removing the intermediary removes the recourse: no chargebacks, no regulator, no support.
  • Smart contract bugs, oracle manipulation and governance attacks are its characteristic risks.

The core idea

Traditional finance runs on institutions. A bank holds deposits and decides who to lend to; an exchange matches orders and holds assets in custody; a broker stands between you and a market. Each is a trusted intermediary, regulated and accountable, and each takes a margin.

DeFi replaces the intermediary with a smart contract — a program deployed to a blockchain that executes automatically and identically for everyone. Anyone can read the code, anyone can call it, and nobody can be refused service or have a position reversed.

The practical difference is that you interact with the protocol directly from your own wallet. There is no account, no onboarding and usually no identity check. Your assets stay in your custody until the moment a contract takes them, and the contract's behaviour is fixed by its code.

The main building blocks

Lending protocols hold pools of deposited assets. Lenders deposit and earn interest; borrowers post collateral and draw against it. Rates are set algorithmically by utilisation — the more of a pool is borrowed, the higher the rate rises. Loans are over-collateralised, typically requiring 150 % or more, because there is no credit check and no way to pursue a defaulter. Fall below the required ratio and the position is liquidated automatically.

Automated market makers replace order books with liquidity pools. Instead of matching buyers to sellers, a pool holds two assets and prices them by a formula — classically x × y = k, keeping the product constant. Traders swap against the pool; liquidity providers deposit both assets and earn a share of trading fees, while taking on impermanent loss.

Stablecoins are the unit of account that makes the rest usable. Some are backed by reserves held off-chain; others are over-collateralised by crypto on-chain. Their stability is the foundation everything else is priced against, which is why a stablecoin failure propagates so widely.

Derivatives and perpetuals offer leveraged exposure without an expiry date, kept near spot price by a periodic funding payment between longs and shorts.

Risks specific to DeFi

These sit on top of ordinary crypto volatility, not instead of it:

  • Smart contract bugs. Code is immutable once deployed, so a flaw is permanent until a migration. Billions have been lost this way. An audit reduces risk but does not remove it — several audited protocols have been drained.
  • Oracle manipulation. Contracts need external price data. If an attacker can distort the price feed, even briefly, they can borrow against inflated collateral or trigger unjust liquidations. Flash loans make this attack cheap to attempt.
  • Liquidation cascades. Automated liquidations in a falling market create selling pressure that triggers more liquidations.
  • Governance attacks. Protocols controlled by token votes can be captured by anyone who acquires or borrows enough voting power.
  • Bridge exploits. Moving assets between chains has been the single largest category of losses, with individual incidents exceeding half a billion dollars.
  • Composability risk. Protocols build on each other, so a failure in one propagates into others that depended on it in ways nobody modelled.
  • No recourse. There is no support desk, no regulator and no reversal. If you approve a malicious contract, that is the end of the matter.

Reading a yield honestly

Advertised yields in DeFi are frequently misleading, and understanding why is the most useful analytical skill in this area. Ask where the yield comes from:

  1. Genuine fee revenue — borrowers paying interest, traders paying swap fees. This is sustainable but usually modest, in low single digits for major assets.
  2. Token emissions — the protocol printing its own governance token to attract deposits. Headline rates can be enormous and are paid in an asset whose price typically falls as emissions continue. The quoted APY assumes the token holds its value, which is precisely what emissions undermine.
  3. Someone else's loss — yields ultimately funded by new deposits. This is a Ponzi structure whatever it is called.

A yield is compensation for a risk. If you cannot identify which risk you are being paid to bear, you are bearing it anyway without knowing what it is. A 200 % APY is not an opportunity others have missed; it is a price the market has set for something.

Frequently asked questions

Is DeFi safer than a centralised exchange?

Different, not safer. You avoid the risk of a company failing with your assets, and you take on smart contract risk, oracle risk and the consequences of your own mistakes — with no recourse for any of them. Both models have produced very large losses.

Do I need to understand the code?

Ideally you would, and almost nobody does. The practical substitutes are: prefer protocols with long operating histories and large amounts at stake, read the audits rather than noting that they exist, check whether the contracts are upgradeable and by whom, and never commit more than you can lose.

What is a flash loan?

An uncollateralised loan that must be borrowed and repaid within a single transaction. If repayment fails, the whole transaction reverts as though it never happened. It has legitimate uses in arbitrage, and it is also the tool that makes several categories of attack economically viable.

Is DeFi regulated?

Largely not yet, and this is changing. Several jurisdictions are extending rules to cover parts of the sector, and the treatment of developers and front-end operators is being actively litigated. Assume no consumer protection applies.