What is DeFi?

What does DeFi actually mean?

The Ethereum project’s own documentation describes it in one line: “DeFi is a collective term for financial products and services that are accessible to anyone who can use Ethereum.” The International Organization of Securities Commissions (IOSCO), the global body for securities regulators, uses a broader definition in its December 2023 final report: “DeFi commonly refers to financial products, services, activities, and arrangements that use distributed ledger or blockchain technologies (DLT), including self-executing code referred to as smart contracts.”

The key ingredient is the smart contract — a program stored on a blockchain that runs exactly as written. ethereum.org puts it plainly: “In DeFi, a smart contract replaces the financial institution in the transaction.” If you are new to smart contracts, start with our guide to what Ethereum is, because most DeFi apps run on Ethereum or networks built like it.

How is DeFi different from a bank or a crypto exchange?

A bank, a broker and a centralised crypto exchange all have one thing in common: a company holds your money or coins and runs the service. In DeFi, the service is code, and you connect to it with a wallet you control.

Holding your own keys removes one risk — a platform freezing withdrawals or going bust — and adds another: if you lose your keys or sign a bad transaction, nobody can reverse it. Our guide to crypto wallets and private keys explains why.

What can you do with DeFi?

Most DeFi activity falls into a few groups:

• Trading. Decentralised exchanges (DEXs) let you swap one token for another directly from your wallet. ethereum.org says: “You never give up control of your assets.”
• Providing liquidity. People deposit pairs of tokens into liquidity pools that traders swap against, in return for a share of trading fees.
• Lending and borrowing. Instead of a credit check, ethereum.org explains, the borrower puts up collateral that the lender automatically receives if the loan is not repaid. The Bank for International Settlements (BIS) notes that DeFi lending tends to be overcollateralised — you usually lock up more than you borrow.
• Flash loans. ethereum.org calls these “a more experimental form of decentralized lending” that let you borrow without collateral. ethereum.org explains: “It works on the basis that the loan is taken out and paid back within the same transaction.” If it is not repaid, the whole transaction reverts.
• Stablecoins. Tokens designed to track a currency like the US dollar act as DeFi’s cash. The BIS says: “Stablecoins allow DeFi market participants to avoid converting to and from fiat money at every turn.” See what stablecoins are and their own risks.

How does a DeFi transaction work, step by step?

Using a DeFi app looks like using a website, but what happens underneath is different:

1. Connect a wallet. The app reads your public address. It cannot move anything without your signature.
2. Approve. For many tokens you first sign an “approval” that lets a specific smart contract move a set amount of that token.
3. Sign the action. You sign the swap, deposit or loan. You also pay a network fee (on Ethereum, called gas — see our guide to crypto trading fees).
4. The contract executes. The blockchain runs the contract’s code. If its conditions are met, the transaction goes through; if not, it fails — and the gas is still spent.
5. The result is final. Once confirmed, the transaction is recorded on the public ledger and generally cannot be undone.

Step 2 matters more than most beginners realise: an approval given to a malicious contract can let it drain that token from your wallet later.

Is DeFi really decentralised?

Often less than the name suggests. A 2021 BIS study is titled “DeFi risks and the decentralisation illusion”, and its summary states: “There is a “decentralisation illusion” in DeFi due to the inescapable need for centralised governance and the tendency of blockchain consensus mechanisms to concentrate power.”

The BIS explains why: “In DeFi, the equivalent concept is “algorithm incompleteness”, whereby it is impossible to write code spelling out what actions to take in all contingencies.” Someone has to decide on upgrades, fees and emergencies — usually developers, a company, or holders of governance tokens.

IOSCO is blunter. It says DeFi governance structures “are often opaque, experimental, unpredictable, and/or easy to manipulate.”

Is DeFi regulated?

IOSCO notes: “Some industry participants have asserted that if something is decentralized, it is not, or cannot be, regulated.” Its report rejects that idea and sets out nine recommendations telling regulators to look for the people who actually control or influence a DeFi product.

The UK Financial Conduct Authority (FCA) has taken the same line. In its June 2026 overview of the new UK crypto regime it says: “Our rules and guidance will apply to DeFi firms where there is an identifiable controlling entity, consistent with the Treasury defined perimeter.” It adds: “We will take a case‑by‑case approach to assessing scope and will consult on tailored DeFi guidance.” The FCA says the full scope of the regime will expand from 25 October 2027.

In practice, many DeFi apps you can reach today are not authorised anywhere. Our guide on checking if a crypto firm is authorised shows how to look a firm up.

What are the risks of DeFi?

Regulators list the same risks again and again:

• Bugs and exploits. ethereum.org itself says: “Ethereum products, like any software, can suffer from bugs and exploits.” The European Securities and Markets Authority (ESMA) warns: “Indeed, if a protocol becomes large enough, any flaw in its smart contract code is very likely to be found and exploited.”
• Hacks. ESMA and IOSCO both cite one blockchain analytics firm’s estimate that in 2022, DeFi protocols were the victims in 82.1% of all crypto-assets stolen by hackers — about USD 3.1bn.
• Bad data from oracles. Smart contracts cannot see prices outside the blockchain, so they rely on data feeds called oracles. ethereum.org warns: “If the oracle becomes corrupt, smart contracts will execute based on bad data.”
• Apps built to steal. ESMA: “Malevolent people can use the technology to anonymously create malicious decentralised applications, which have no other purpose than to deprive users of their money.” “Rug pulls”, where insiders drain a project’s funds, are one version — see our crypto scam red flags.
• No one to turn to. ESMA: “Another important source of risk for DeFi users is the lack of a clearly identifiable responsible party and the absence of a recourse mechanism if things go wrong.”
• Price risk. The tokens used in DeFi carry the same volatility as other crypto. The FCA says anyone buying crypto should be prepared to lose all the money they put in.

Blockhorizon is an education site. Nothing here is a recommendation to use any DeFi app, token or staking service.