In DeFi, there are three ways to earn interest on your money: lending it out (lending), locking it up to validate networks (staking), or providing liquidity to exchanges (liquidity pools). Typical yields in May 2026: 2.5-8.5% for lending, 3-12% for validation, 4-40% for liquidity (high volatility). The numbers seem clear until you look at what actually happened: in April 2026, the ecosystem lost $606.7M due to attacks — 3.4 times the $178.1M lost in March. On April 18, depositors of Aave (the world's largest lending protocol, $25B in TVL) were unable to withdraw their funds for 48 hours following the Kelp DAO hack. This comparison is not a catalog of theoretical yields — it's what happened in May, what percentage of total capital was affected, and what the real damage was to the average user.
This article compares the three real ways to generate yield in DeFi (lending, validation, liquidity) using materialized, not abstract, data. Specific cases from the last 60 days, the percentage of capital affected in each incident, what happened to trapped users, and how to decide based on your profile. If you're going to put money to work in DeFi, this is what you need to know first.
Editorial Note: This article is for informational purposes only and does not constitute financial advice. DeFi yields change weekly. Data as of May 2026. Sources: DefiLlama Yields, Chainalysis, official dashboards of each protocol.
What are the 3 ways to earn yield in DeFi and how do they differ?
Before comparing numbers, it's important to understand what each strategy does with your money.
- Lending: You deposit your money (typically stablecoins like USDC or ETH) into a common pool. Other users borrow it in exchange for interest. You collect part of that interest. Like a bank — but the "bank" is an automated, overcollateralized smart contract (the borrower must deposit more value than they borrow).
- Validation (staking + restaking): You lock up your crypto (ETH, SOL) to help a blockchain process transactions. The network pays you for this security — because if you validate incorrectly, you lose your deposit. Restaking adds a layer: you use the same capital to secure other services (data, oracles) and earn more.
- Liquidity (liquidity pools): You deposit pairs of assets (e.g., ETH + USDC) into a decentralized exchange. Every time someone swaps those assets, you get a share of the fee. In return, you assume the risk that the price will move and you'll end up with more of the "losing" asset.
All three are legitimate. All three have different risks. The question isn't which pays the most in gross terms — it's which fits your risk tolerance and available management time.
What yields does each strategy offer in May 2026?
Let's start with the gross figures. This is the comparative basis before discounting for risks:
| Strategy | Typical Yield | Capital Added in May | Withdrawal Liquidity |
|---|---|---|---|
| Lending | 2.5 % – 8.5 % | ~$54B | Immediate |
| Native Ethereum Staking | 3 % – 4 % | $90B+ | 7-21 days |
| Native Solana Staking | 7 % – 8 % | $25B+ | 2-3 days |
| Layered Restaking (LRTs) | 8 % – 12 % | ~$11B (EigenLayer) | 7-30 days |
| Liquidity in Stable Pairs | 4 % – 12 % | Variable | Immediate |
| Liquidity in Volatile Pairs | 20 % – 40 %+ | Variable | Immediate |
The first important piece of information: any sustained yield above 20% annually is a red flag. In lending and staking, high figures always include inflationary emissions or temporary incentives that are not sustainable. In liquidity, high figures are accompanied by impermanent loss (we'll see this below with real numbers).
How do decentralized loans work and who are the main players?
The DeFi lending market moves $54B distributed across more than 380 platforms. But the concentration is enormous: the top 5 protocols capture more than 75% of the total capital.
| Protocol | How it works | Capital Deposited | USDC APY |
|---|---|---|---|
| Aave V3 | Single common pool — all liquidity aggregated | $19.4B | 3.8 – 6.2 % |
| Spark | Variant of the Aave model (Sky project branch) | $6.8B | 4.5 – 7.5 % |
| Morpho Blue | Independent vaults with external risk curators | $4.9B | 4.0 – 8.5 % |
| Compound V3 | Isolated markets for each asset pair | $2.7B | 3.5 – 5.8 % |
| JustLend | Classic common pool model (Tron network) | $2.4B | 2.5 – 4.0 % |
| Kamino Lend | Isolated markets on Solana | $1.48B | 4.0 – 9.0 % |
| Euler V2 | Flexible modular vaults | $890M | 3.8 – 8.0 % |
The difference between architectures matters when something goes wrong. In Aave V3 (single pool), if a new asset goes bad, it contaminates ALL depositors. In Compound V3 (isolated markets), the risk is contained within that specific pair. Morpho Blue goes further: each vault has its own curator who defines the risk rules.
What happens when lending fails? The Aave-Kelp case of April 18
This is what happened when theory materialized.
On April 18, 2026, an attacker exploited a vulnerability in Kelp DAO's cross-chain bridge (a restaking protocol). They minted 116,500 fake rsETH tokens — 18% of the circulating supply — and deposited them as collateral in Aave V3. They borrowed $290M in real ETH and stablecoins. Then they mixed the funds via Tornado Cash. We covered the technical details in our comparison of cross-chain bridges post-hacks 2026.
What happened to the average Aave user:
- Latent losses: $200M of uncollectible debt detected within hours (0.8% of Aave's total TVL).
- Insufficient safety fund: Aave's insurance covered only $80-100M, half of what was needed.
- Immediate bank run: In 48 hours, $5B was withdrawn from the protocol — 20% of the TVL exited.
- Legitimate depositors trapped: Most of the legitimate ETH was lent to third parties. Liquid reserves were exhausted. Users could not withdraw for 48 hours.
- Interest rates skyrocketed: Stablecoin APYs on Aave jumped to 10-12% annually during the run — good for those with deposits, bad for those with open loans.
Resolution: the DeFi United coalition organized a coordinated bailout. Lessons: the risk of DeFi lending is not primarily in the loans — it's in what is accepted as collateral. If something manipulable is accepted, the entire system becomes contaminated.
What is native staking and why was "liquid staking" born?
Native staking is simple: you lock up ETH (or SOL, ATOM, etc.) for weeks or months, and the network pays you 3-8% annually for securing transactions. The historical problem: the money is illiquid. If you need liquidity before the term, you can't exit without losing rewards.
Liquid staking tokens (LSTs) solve this. When you deposit ETH into Lido, you receive an equivalent token (stETH) that represents your position. You can sell that token, use it as collateral, exchange it — without losing the underlying staking rewards.
| Validation Strategy | Token you receive | Capital Added | APY |
|---|---|---|---|
| Native ETH Staking (no LST) | None (locked) | $90B+ | 3-4 % |
| Lido (stETH) | Transferable stETH | $26B | 3-4 % + MEV |
| Jito (Solana) | Transferable JitoSOL | ~$5B | 7-8 % + tips |
| EigenLayer (restaking) | Position + additional use | $11B | Variable |
| ether.fi (LRT) | Layered eETH | $4.5B | 8-12 % |
| Renzo Protocol | Layered ezETH | $2.8B | 8-12 % |
| Kelp DAO | Layered rsETH | $1.2B | 8-12 % |
What happens when staking fails? The rsETH case of April 18
This is where the "layered yield" theory broke down. We return to Kelp DAO because it's the same event — but from the staker's angle, not the lending depositor's.
What happened to the rsETH holder (Kelp DAO's liquid restaking token):
- 18% of the supply was fake: overnight, 116,500 of the circulating rsETH lacked real backing. The secondary market price fell by 22% in hours.
- Price de-peg: rsETH stopped being 1:1 with ETH for several days. Anyone who had to sell during that period lost 15-22% vs pure ETH.
- Operations frozen: Kelp DAO paused the network for 48 hours to assess damages. If your position was in an auto-rebalancing vault, you received an automatic haircut.
- Contagion effect: The prices of ezETH (Renzo) and eETH (ether.fi) also fell 5-8% due to fear of similar vulnerabilities — without those protocols suffering attacks.
Lesson: layered yields (8-12%) look good until you see the layered risks. Each extra layer of yield (staking → restaking → AVS) adds an additional point of failure. We covered it in detail in the architectural analysis of the exploit.
What about slashing? How much is actually lost for bad validation?
The fear of "slashing" (penalty for incorrect validation or double signing) is exaggerated compared to its actual frequency. Accumulated network data from each chain's inception until May 2026:
| Network | Staked Capital | Slashed Tokens (cumulative) | % Slashed |
|---|---|---|---|
| Ethereum (since Dec 2020) | ~35M ETH (30% of total) | ~16,000 ETH (~600 validators) | 0.046 % |
| Cosmos Hub | ~200M ATOM (65%) | ~50,000 ATOM | 0.025 % |
| Polkadot | ~700M DOT (50%) | ~150,000 DOT (5 incidents) | 0.021 % |
| EigenLayer (active slashing Apr 2025) | $9.5B restaked | ~$5-8M | 0.06 % |
| Lido (covers user slashing) | 9.5M ETH custodied | ~700 raw ETH / 0 net | 0 % to user |
| Avalanche / Solana | $600M and 380M SOL | No formal material slashing | ~0 % |
Consolidated figure: across the ~$420B staked globally, ~$120-150M has been lost due to slashing cumulatively over 5 years of PoS operation. That's ~0.03% of staked capital — 40× lower than annual losses from DeFi hacks (1.2% of TVL) and half the rate of traditional banking fraud (0.06% annually).
The reason: severe slashing (50-100% of stake) requires very specific actions — double signing blocks or coordinated attacks. Common occurrences are jailings for being offline, which penalize ~0.01% of the stake and are easily recoverable. Statistically, slashing is the smallest of all DeFi risks. The real danger of liquid staking and restaking is not technical slashing, but hacks of bridges and oracles (rsETH case described above). Sources: beaconcha.in (Ethereum), mintscan.io (Cosmos), polkadot.subscan.io, official Lido/EigenLayer dashboards.
What is providing liquidity to an exchange and how is it paid?
Decentralized exchanges (DEXs) like Uniswap or Curve need someone to deposit both assets of the pair (e.g., ETH + USDC) into a common pool. When another user makes a swap, they pay a fee (0.03% – 1%). That fee is distributed among those who provided liquidity.
In 2026, the dominant model is concentrated liquidity: instead of providing to the entire price range, you choose a narrow band (e.g., ETH between $3,500 and $4,500). If all volume passes through your band, you multiply the fees you receive by 3-5. But if the price leaves the band, you stop receiving fees — and worse: you end up with all your capital in the asset that lost value.
How much is actually lost due to impermanent loss?
"Impermanent loss" sounds abstract. In concrete figures: you deposit $10,000 equally into ETH + USDC when ETH is at $3,000.
| If ETH moves to... | Passive Value (doing nothing) | Value in Liquidity Pool | Loss vs. Not Depositing |
|---|---|---|---|
| $4,500 (+50 %) | $12,500 | $12,250 | −2.0 % |
| $6,000 (+100 %, 2×) | $15,000 | $14,140 | −5.7 % |
| $9,000 (+200 %, 3×) | $20,000 | $17,320 | −13.4 % |
| $12,000 (+300 %, 4×) | $25,000 | $20,000 | −20.0 % |
Reading: if ETH goes up 100%, you still gain — but 5.7% less than you would have gained by simply not providing liquidity. The fees collected can offset this loss (hence the 10-40% APYs in volatile pairs), but it requires sufficient volume and moderate price movement. If the price doubles suddenly, a month's worth of fees won't offset the impermanent loss.
In narrow concentrated ranges (5% band), the loss accelerates exponentially. If the price leaves the band, you are left with 100% of the "losing" asset and no fees — the worst possible combination.
How does providing liquidity fail in practice? 3 recent cases
These are not theoretical scenarios. These are things that happened between February and May 2026.
February 2026 — AI agent cascade: $400M forcibly liquidated
The market corrected by 20% in a few hours. Thousands of AI agents programmed to automatically manage liquidity simultaneously triggered their exit thresholds. They emptied the deepest liquidity pools on Aave, Compound, and Kamino in seconds. Result: price slippage was amplified so much that $400M in forced liquidations were executed — users who had no intention of selling lost their positions because the agents moved the price.
April 2026 — Cork Protocol, Uniswap v4 hooks hack: $12M
Cork Protocol built an integration on Uniswap v4 using "hooks" (code extensions that customize pool behavior). A flaw in the access control of the unlockCallback() function allowed an external attacker to invoke internal functions. They drained $12M from the protocol in one transaction.
May 2026 — Raydium volatile pairs on Solana: extreme impermanent loss
Memecoins launched in SOL pairs with concentrated liquidity in 5% bands. When prices fell 80-90% in 24 hours, liquidity providers ended up with 100% of the memecoin (which is now worthless) and 0% of SOL. Real capital loss of 90%, covered by less than 0.5% in collected fees.
How often do hacks occur and what percentage of capital is actually lost?
Quantitative data from the last 24 months, according to Chainalysis, Hacken Research, and forensic firms like CertiK:
| Period | Total Losses | % of Aggregated TVL Affected | Frequency |
|---|---|---|---|
| 2024 Full Year | $64.5B | ~0.5 % | ~310 registered incidents |
| 2025 Full Year | $158B | ~1.2 % | ~470 incidents (+52 %) |
| March 2026 | $178.1M | 0.13 % monthly | ~30 incidents |
| April 2026 | $606.7M | 0.45 % monthly | ~45 incidents (+50 %) |
To put it in perspective: the credit card fraud rate in traditional systems is approximately 0.06% annually. DeFi has a monthly loss rate (0.13-0.45%) similar to the annual rate for credit cards. The risk is real, quantifiable, and 10-100× greater than in traditional finance. But there are serious protocols with clean track records:
- Aave (2020-present): April 2026 incident was the first material loss in 6 years of operation. Track record: 99.2% of TVL never affected.
- Lido (2020-present): 0 material slashing penalties (bad validation) in 6 years. stETH has maintained parity with ETH within ±3% the entire time.
- Curve: July 2023 hack of $70M (0.4% of its peak TVL). Rest of the history clean.
- Uniswap v3 (2021-present): zero material hacks. The May 2026 problems are in external v4 hooks, not in the core code.
Which strategy suits you best based on your profile?
The choice is not theoretical — it depends on capital, available time, and risk aversion. This is the matrix we use as a reference:
| Profile | Optimal Strategy | Why |
|---|---|---|
| Conservative (>$50,000, no time) | Lending on Aave V3 or Morpho with USDC | 3.8-6% APY, immediate withdrawal, 6 years of clean history (except April 2026) |
| Moderate ($5,000-$50,000) | 50% lending + 50% liquid staking (stETH/JitoSOL) | Captures organic network yield without layered risk |
| Active (with time for weekly review) | Lending + LRT (10-20% maximum) | Accepts complexity for an additional 8-12% |
| Algorithmic Professional | Concentrated liquidity with automatic management (Gamma, Arrakis) | 40% possible — but requires daily monitoring and professional tools |
What DeFi portfolio structure do institutions recommend in 2026?
After the Aave run on April 18, the pattern being adopted by corporate treasuries and institutional portfolios is this:
- 30-50% in cold self-custody — no exposure to yields. This is your solvency anchor. It generates no interest, but also suffers no systemic software failures.
- 30-50% in leading liquid staking — stETH (Lido) or JitoSOL. Organic yield of 3-8%, low risk, high secondary liquidity.
- 10-30% in layered restaking — only in LRTs with mature AVS and validator diversification. Assumes the April 18 risk as known.
- 0-10% in aggressive strategies — concentrated liquidity or leveraged loops. Assumes possibility of total loss.
What signals should DeFi users watch out for in May 2026?
Practical indicators to monitor over the next 90 days:
- Aggregated monthly losses: if they exceed $800M in a month, the market enters a systemic stress zone. Consider reducing LRT exposure.
- TVL / insurance fund ratio in Aave: after April, it should exceed 2% (in April it was 0.4%). If it drops below 1%, there's a risk of a bank run in another event.
- stETH vs ETH price spread: greater than ±3% indicates liquidity stress in secondary markets. If it exceeds 5%, consider reducing exposure.
- Slashing volume in EigenLayer AVS: starting in May, AVS can penalize validators. If there are 3+ material slashing events in a quarter, avoid LRTs until normalization.
- New MiCA regulation (July 1, 2026): unlicensed stablecoins as regulated dollars will be excluded in the EU. Verify that your stablecoin has an EMT license before that date.
Key takeaway for the reader: DeFi yields (3-40%) are real, but risks are also real, quantified, and materialize regularly. In the last 24 months, more than 1% of annual TVL has been lost due to attacks — 10-100× the loss rate of the traditional banking system. The good news: most losses are concentrated in new, complex, or low-history protocols. Aave lost in April 2026 after 6 years without material incidents. Lido has gone 6 years without penalty. These are not random numbers — they are indicators of which architectures work under real stress. If you are going to generate yield in DeFi, prioritize protocols with 3+ years of operation without material incidents. It's the difference between a safe 5% and a 12% with a high probability of losing everything.
Frequently Asked Questions about DeFi Yield Strategies
What is the safest strategy to start with?
For someone starting out, the most conservative approach is to deposit stablecoins (USDC or USDT) into Aave V3 or Morpho Blue. APY 3.8-6%, almost immediate withdrawal, 6-year track record. It's the closest thing to an interest-bearing savings account — with the caveat of the specific April 2026 incident, which has already happened and is documented.
Is restaking worth it with 8-12% APY?
Only if you understand and accept that you are adding 3 layers of risk on top of basic staking. When you see "11% APY," it actually means "3% from the network + 1% from MEV + 4% from AVS services + 3% from governance incentives." Each component can fail independently. The Kelp DAO case of April 18 showed that it's possible to lose 18% of the token's value in hours. For many people, the difference between 4% (basic staking) and 11% (restaking) does not compensate for the risk.
What is "impermanent loss" in providing liquidity?
It is the mathematical cost of providing liquidity to a pair of assets. When the price of one of the assets changes, the pool's algorithm forces you to hold more of the one that loses value. If ETH goes up 100%, you would have more USDC and less ETH than you would have had without providing liquidity — you end up with ~5.7% less value than you would have had by passively HODLing. The fees collected can offset this loss if there is enough volume, but it requires moderate price movement.
Is Aave safe after the April incident?
Paradoxically, safer than before. The incident exposed the problem (manipulable cross-chain collateral) and forced structural changes — additional oracle verification, higher safety ratios, strengthened insurance fund. Aave remains the lending protocol with the most TVL in the world and the best track record. But the lesson is general: no protocol is 100% safe. Diversifying across 2-3 different lending protocols reduces concentrated risk.
Are stablecoins immune to impermanent loss risk?
Almost, if they are of the same type. A USDC-USDT pair on Curve has negligible impermanent loss because both tokens track the dollar and rarely deviate by more than 0.1%. But a USDC-DAI pair can suffer loss if DAI temporarily loses its peg. And a volatile stablecoin-crypto pair suffers all the normal impermanent loss.
How does MiCA (European regulation) affect my DeFi strategy?
As of July 1, 2026, stablecoins without a European license (EMT) will not be able to circulate legally in the EU. USDC (Circle) and EURI already have licenses. USDT (Tether) is in process but with uncertainty. If you operate from Spain or another EU country, verify that your main stablecoin has an EMT license before June 30 (specific Spanish deadline). For native staking and lending in general, there are no changes — the regulation only affects stablecoins.