DeFi Protocols for Beginners

A DeFi protocol is a set of smart contracts that holds deposits and moves them according to fixed rules without a bank or broker in between, and the sensible first act for a newcomer is to read one before depositing in it. DefiLlama tracks more than 7,000 of them, the sector held $95.42 billion on September 26, 2026 by Inside Deep Tech's count, and in the third quarter of 2026 $1.2 billion was lost across 247 exploits. This page takes a reader from the definition to a written one-paragraph account of a single protocol: what it does, where its yield comes from, what has gone wrong with it and who can change its rules.

Everything else on the subject rests on one idea. A DeFi protocol is a program that has custody of other people's assets and treats them exactly as its code says. The program is a smart contract: software deployed on a blockchain that executes as written when someone sends it a transaction. The U.S. Congressional Research Service, in its primer on decentralized finance (issued March 16, 2026, updated April 17, 2026), defines DeFi as financial services conducted through such protocols without centralized intermediaries. It adds a stricter test: to count as decentralized, the protocol must be autonomous, permissionless and transparent, with no central party in control. Many protocols pass part of that test and not all of it.

A lending protocol shows the idea at work. A depositor puts stablecoins into a shared pool. A borrower who wants to draw from that pool must first lock up collateral (assets pledged against the loan) worth more than the loan itself. The practice is called overcollateralization, and it is how the protocol lends to strangers without checking anyone's credit. The interest rate is not set by a loan officer. It moves automatically with utilization, the share of the pool currently lent out: the more is borrowed, the higher the rate. If the collateral's value falls below a set threshold, the contract sells it to repay the loan. That sale is a liquidation, and nobody has to approve it. The depositor's yield is simply the borrowers' interest.

The largest protocols are usually ranked by TVL, total value locked: the dollar value of assets sitting in a protocol's contracts. On DefiLlama's late-September 2026 snapshot, Lido led at roughly $26.46 billion, followed by Aave at about $19.145 billion. Trackers count slightly differently, so the same protocol can carry somewhat different figures on different sites. A size figure is not a safety rating either. As one research page on the rankings puts it, "TVL measures size and liquidity, not safety or yield."

The phrase "just code" also needs a qualification. Plenty of protocols keep admin keys, privileged credentials that can change or pause the contracts. As later sections show, those keys have become the favored point of attack. Who can change the code is also the question of governance, which on many protocols means a vote by holders of the protocol's token. A separate page here sets out how the code differs from the organization that votes on it.

The protocols fall into a handful of types. Each holds money for a different reason and pays for a different reason. The figures below are as the sources gave them, on the dates shown.

Two features of the table matter more than any single row. The first is concentration. In one count of the top 100 protocols, the ten largest held 48.4% of the total, so a newcomer will meet a small number of names repeatedly. The second is that the categories lean on one another. A lending market accepts liquid staking tokens as collateral, and a bridge supplies the wrapped asset a DEX trades. A failure in one category therefore rarely stays inside it.

Very little. The first result described below needs a web browser, three public sources and somewhere to write a paragraph. The sources are DefiLlama's protocol rankings for size and category, Rekt for the record of exploits above roughly $3 million, and the chosen protocol's own documentation.

It needs no wallet, no deposit and no transaction fee, because nothing is signed and nothing is sent. That is deliberate. Every mistake on the list further down costs money only once a wallet is connected, and the reading is what tells a newcomer whether connecting one is worth it. A single sitting is enough for one protocol.

The first real result is a short written account of one protocol, built from its own figures and history. The steps below use lending as the example because its mechanism is the easiest to check. The same steps work for any category.

The fifth step is the one most newcomers skip, and it is the one that most often decides the outcome. The way token votes and forum proposals approve changes at the large lending protocols is laid out on the page about who approves contract changes.

Treating size as safety. A large TVL figure says many people have deposited. It does not say the deposits are safe. The sign of this mistake is a decision that cites only rank. The remedy is the incident search in step four.

The strongest objection deserves a full hearing. The largest protocols have run longest, attracted the most scrutiny and survived the most stress, so size is not a useless signal. That is fair, and it is why the steps begin with the rankings. But size does not isolate a protocol from its neighbors. When the KelpDAO bridge was breached on April 18, 2026 and 116,500 unbacked rsETH were minted, Aave's TVL fell $6.28 billion within 48 hours and nine protocols froze markets. Aave's own code was not the cause. A large protocol tends to inherit the risks of everything it accepts as collateral.

Reading an audit as a guarantee. An audit is a review of code at a point in time. Drift Protocol lost $285 million on April 1, 2026 in 128 seconds through a compromised admin key. A 2024 audit had flagged the mechanism involved but rated it only "informational." KelpDAO had also been audited. The sign of this mistake is the word "audited" in a decision with nothing after it. The remedy is to read the audit's list of findings and check what was left unfixed.

Supplying liquidity to a DEX without pricing impermanent loss. Impermanent loss is the gap between the value of assets deposited in an AMM pool and the value of the same assets simply held. It appears when the two tokens' prices diverge, and it becomes permanent if the provider withdraws while they are still apart. Swap fees earned are kept either way. The sign of this mistake is a withdrawal worth less than the original holdings would be. Chainlink's explainer gives the scale.

Approving the wrong token, or forgetting the approval. Before a contract can move a token from a wallet, the wallet has to grant it permission. Blockchain Council lists approving the wrong token, or skipping the approval entirely, as a common first error. The sign is a transaction that fails or a permission that is broader than intended. Phishing accounted for about 11% of third-quarter 2026 incidents, so an approval signed on the wrong site is the costlier version of the same mistake. Practices for checking and revoking approvals belong to the step after this one.

The second thing is to repeat the exercise in a different category and compare the two paragraphs. Lending and liquid staking are the obvious pair, since they are among the largest categories and they depend on each other. The comparison shows something the first read cannot: a deposit in one protocol carries the risks of the protocols it rests on.

The second read should add one question the first did not ask: is a person making decisions with the money? SEC Commissioner Hester Peirce warned on July 24, 2026 that automated vaults and onchain lending products, a sector of about $131 billion, may be unregistered investment companies where human curators rebalance them at their discretion. Morpho's governance token fell sharply after the warning. Whether a protocol runs purely on fixed rules or on someone's judgment now matters for its legal standing as well as its risk.

Only after that does it make sense to deposit, and then in an amount small enough to learn the mechanics without the lesson being expensive.