Research note · 2026-11-06 · Data: DefiLlama, ETHBEAT (formerly L2BEAT), ethereum.org, CFTC and SEC releases

A loan on Aave, a swap on Uniswap and a staking deposit with Lido have one thing in common: no employee approves them. Each is a call to a smart contract, a program stored on a public blockchain that holds assets and moves them according to code anyone can read. Decentralized finance, or DeFi, is the collective name for those contracts and the markets that form around them.

ethereum.org’s DeFi page (page updated 2026-10-16) defines it as “a collective term for financial products and services that are accessible to anyone who can use Ethereum.” The definition has since widened to other chains, but the core idea holds: financial logic runs as public code, users keep custody of their assets in their own wallets, and settlement happens on a shared ledger rather than inside a bank’s database.

This note walks through the stack, the main primitives, where the capital sits today, and the places where things break.

The stack, bottom to top

It helps to think of DeFi as five layers, each depending on the one beneath it.

  1. Settlement layer. A base blockchain (Ethereum, Solana, BNB Chain and others) orders transactions and enforces the state. Its security model sets the ceiling for everything above it.
  2. Scaling layer. Rollups and other layer 2 networks execute transactions off the base chain and post data or proofs back to it. How much security a layer 2 actually inherits depends on its proof system and upgrade controls.
  3. Assets. Native coins (ETH, SOL), stablecoins, wrapped assets that represent tokens from other chains, and receipt tokens such as liquid staking tokens or LP shares.
  4. Protocols. The contracts that do something with those assets: exchanges, lending markets, derivatives venues, staking pools, yield vaults.
  5. Interfaces and aggregators. Websites, wallets and routers that build transactions for users. These are usually run by companies and can be geoblocked or changed even when the contracts underneath cannot.

The distinction between layers 4 and 5 matters more than most users assume. A protocol’s contracts may be immutable, while the front end that most people use is an ordinary web app operated by a legal entity with terms of service.

The core primitives

Exchange

Decentralized exchanges let users swap tokens against a contract instead of a broker. Most early volume ran through automated market makers, which price trades from a formula over pooled reserves. The Uniswap v2 whitepaper (March 2020) describes the model: each pair stores reserves of two assets and maintains “the invariant that the product of the reserves cannot decrease,” with a 30-basis-point fee paid to liquidity providers. The mechanics are covered in automated market makers.

DefiLlama’s DEX overview recorded about $11.68 billion in DEX volume for 2026-11-05.

Lending

Lending markets pool deposits and let other users borrow against collateral. Loans are overcollateralized: the borrower posts more value than they take out, and if the collateral’s value falls below a threshold, anyone can repay part of the debt and seize collateral at a discount. That process, liquidation, is what keeps the pool solvent without credit checks.

Stablecoins

Stablecoins are the unit of account for most of DeFi. DefiLlama’s stablecoin dashboard put total circulating supply at about $294.5 billion on 2026-11-05. Designs range from fiat-backed tokens redeemable with an issuer to crypto-collateralized tokens minted against on-chain debt positions. In the US, the GENIUS Act (signed 2025-07-18) sets a federal framework for payment stablecoins, requires reserves of at least 1:1, and bars issuers from paying yield simply for holding the coin; its effective date is the earlier of 2027-01-18 or 120 days after final regulations.

Staking and liquid staking

Proof-of-stake chains pay validators for securing the network. ethereum.org’s staking pools page notes the 32 ETH minimum to activate a validator and says liquid staking protocols “account for around a third of all staked ETH.” Liquid staking tokens let depositors keep a transferable claim while their ETH is staked. See liquid staking; restaking extends the same idea by pledging staked assets to additional services.

Derivatives

Perpetual futures dominate on-chain derivatives. They are futures with no expiry, kept near the spot price by periodic funding payments between longs and shorts. The mechanics and the US regulatory position are in perpetual futures.

Composability and flash loans

Because contracts can call each other inside one transaction, a single transaction can borrow, swap, repay and settle in sequence. The Uniswap v2 whitepaper describes “flash swaps,” which let a trader receive assets and use them elsewhere before paying for them later in the same transaction. If repayment fails, the whole transaction reverts. Flash liquidity is a useful tool for arbitrage and liquidations, and it also lets an attacker borrow a large amount of capital for a single block at no upfront cost, which is why several governance and oracle exploits used it.

Where the capital sits

DefiLlama’s headline DeFi TVL was about $85.05 billion on 2026-11-05. By chain, Ethereum led at roughly $43.3 billion, followed by Base ($5.9 billion), Solana ($5.3 billion), BNB Chain ($5.1 billion) and Tron ($5.0 billion), per DefiLlama’s chains endpoint on 2026-11-06.

Category totals from DefiLlama’s protocol list on 2026-11-06:

Category (DefiLlama label) TVL, USD
Liquid staking ~$51.0B
Lending ~$49.8B
Restaking ~$9.1B
CDP (collateralized debt positions) ~$6.6B
DEXs ~$12.6B
RWA ~$3.7B
Derivatives ~$1.9B

These category figures add up to more than the headline. DefiLlama’s default headline applies exclusions to reduce double counting (a liquid staking token deposited as lending collateral would otherwise count twice), so read each line on its own rather than summing them. TVL also moves with token prices, so a falling figure can reflect price rather than withdrawals. TVL is a size measure, not a safety measure.

On the scaling side, ETHBEAT (the analytics site formerly called L2BEAT) showed about $37.5 billion in total value secured across tracked Ethereum scaling projects on 2026-11-06, with Base, Arbitrum One and OP Mainnet the three largest rollups.

How DeFi differs from a bank, mechanically

ethereum.org’s comparison table lists custody (users hold their own funds), settlement speed, open access, always-on markets, pseudonymity and transparent code. Each of those has a matching cost:

  • Self-custody means no password reset and no chargeback. A signed transaction is final.
  • Open access means counterparties are unknown and can include attackers who read the same code.
  • Transparency means exploitable bugs are public to everyone at once, and a fix requires an upgrade path, which in turn requires someone to hold upgrade keys.
  • Always-on markets mean liquidations and oracle updates keep running at 3 a.m. on a Sunday.

There is no deposit insurance on DeFi positions. The FDIC’s $250,000 coverage applies to deposits at insured banks, not to tokens held in a wallet or a smart contract.

Where it breaks

Most losses trace back to a short list of failure modes. A fuller checklist is in the DeFi risk checklist; the summary:

  • Smart contract risk. A bug in code that holds funds. Nomad’s root cause analysis traced its 2022 bridge loss to an upgrade on 2022-06-21 that let unproven messages pass verification.
  • Oracle risk. A protocol reads a price that can be pushed. The CFTC’s January 2023 complaint over Mango Markets alleged that a trader pushed up the MNGO price on venues feeding the oracle (the oracle price rose more than 13-fold in 30 minutes) and withdrew over $110 million against the inflated collateral.
  • Governance and admin-key risk. Whoever can upgrade a contract or change parameters can, in the worst case, redirect funds. Beanstalk’s post-mortem says an attacker used a flash loan to exploit its governance process and took about $77 million from its liquidity pools in April 2022.
  • Bridge risk. Assets moved between chains are only as safe as the bridge’s verification. Sky Mavis stated that 173,600 ETH and 25.5 million USDC were drained from its Ronin bridge in March 2022 after validator nodes were compromised.
  • Depeg risk. A token designed to track a dollar or ETH can trade below it. TerraUSD lost its peg in May 2022; the SEC’s June 2024 release announced a settlement of more than $4.5 billion with Terraform and Do Kwon and says roughly $40 billion in market value was erased.
  • Liquidation risk. Leverage on volatile collateral can be closed out in a fast move, sometimes at worse prices than the threshold implies because liquidators and gas fees compete in the same blocks.

The US regulatory position, briefly

Running financial logic in a smart contract does not move it outside existing law. In September 2023 the CFTC charged Opyn, ZeroEx and Deridex with illegally offering leveraged and margined retail commodity transactions in digital assets, and its enforcement director stated the agency would pursue unregistered platforms that let US persons trade digital asset derivatives. Many derivatives front ends now restrict US users in their own terms; dYdX’s software terms (last updated 2026-03-12), for example, list persons in the United States, Canada and the United Kingdom as restricted from its perpetuals trading software.

The SEC’s May 2025 staff statement on protocol staking is a staff view, not a rule, and it excludes liquid staking and restaking. Tax reporting also applies: custodial brokers issue Form 1099-DA, with gross proceeds for 2025 trades and cost basis for covered assets from 2026.

This is a description of mechanisms, not a recommendation to use any protocol or hold any asset.

Reading a protocol, in order

For anyone evaluating a specific protocol, the sequence that tends to surface problems fastest:

  1. Read the docs for who can upgrade or pause the contracts, and through what delay.
  2. Find the audits and check whether the audited commit is the deployed one.
  3. Identify every oracle the protocol relies on and how it would behave in a thin market.
  4. Check what share of deposits sits in a handful of wallets.
  5. Map dependencies: which bridges, stablecoins and other protocols must keep working for this one to work.

The full framework is in how to research a crypto project.

FAQ

Is DeFi the same as crypto? No. Crypto covers the assets; DeFi refers specifically to financial services built as smart contracts. A centralized exchange trades crypto but is not DeFi.

Who runs a DeFi protocol? Usually a mix: a development company or foundation that wrote the code, a token-holder governance process that can change parameters, and sometimes a multisig with emergency powers. The docs should say which.

Does high TVL mean a protocol is safe? No. TVL measures how much is deposited. Large pools are also larger targets.

Can a transaction be reversed? Not by the protocol in the normal case. Some protocols can pause contracts or freeze specific assets, which is itself a centralization point worth noting.

Sources