What is DeFi? An explanation from scratch

If you have arrived here from the two previous articles in the series —What is Bitcoin? and What is Crypto?— you already have the rails in place: a blockchain is an ownerless architecture where anyone can create their own points system, and on programmable architectures like Ethereum, any "point" can move according to the rules written by a program. DeFi is the natural consequence of bringing the two together: if I can write a program that says "if you deposit X points, I will lend you Y points at this rate, and if your collateral falls, I will automatically liquidate you," I have just built a banking service that doesn't need a bank. This article —the third and final in the series— closes the circle. It covers the why, not the products one by one; for that, we have specific articles linked at the end.

What is DeFi if you understood Bitcoin and blockchain?

DeFi stands for decentralized finance. The label is somewhat unfortunate because it emphasizes what it is not —no banks, no intermediaries— instead of what it is. A more useful definition: DeFi is the set of financial services built as programs that live on a programmable blockchain, executing identically for anyone who connects, without the need for permission or a human intermediary.

Three pieces make up that definition, and all come from the previous articles:

• A programmable blockchain (Ethereum, Solana, L2s) that executes code deterministically and verifiably. Piece from Article 2.
• Smart contracts that encode the rules of the service (lending, exchange, savings, derivatives). Piece from Article 2.
• Tokens —native currencies, stablecoins, other assets— which are the "points" used for operations. Piece from Article 2.

The result: a financial market that operates under the properties you already know from the architecture — operational neutrality, final settlement, auditable transparency, and the absence of a gatekeeper. And under the risks you also already know — pseudonymity, irreversibility of errors, and technical dependence on the code you execute. The novelty of DeFi is not any of the ingredients; it is the combination.

What financial services can be built without a bank?

The list is long and growing, but the stable categories as of 2026 are reasonably few. Mentioning them briefly serves to map the landscape; each has its own specific analysis in the product guide.

• Lending and borrowing. You deposit tokens into a protocol (Aave, Compound, Morpho) and earn interest paid by borrowers. Or you lock collateral and take a loan against it, without credit checks because the collateral covers the loan automatically.
• Exchange. You swap one token for another on decentralized exchanges (Uniswap, Curve, Raydium) that execute the trade against liquidity pools instead of traditional order books. There is no broker in the middle.
• Savings and yield. You deposit into vaults that automate yield-generating strategies: lending, staking, providing liquidity, or combining several at once.
• Derivatives. Perpetual futures, options, structured products (dYdX, Hyperliquid, GMX, Derive). They allow for complex exposures without centralized custody.
• Real World Assets (RWA). Tokens backed by Treasury bills, private credit, or real estate. Paradoxically, this is the DeFi segment closest to the traditional financial system.
• Stablecoins. We already covered these in the previous article — they are the largest category by capitalization and the one that sustains the rest.

All these services operate on the same rails, talk to each other (a token from one protocol is used as collateral in another), and are built incrementally. This chaining of protocols, where the output of one is the input of another, is called composability, and it is the property that most differentiates DeFi from the traditional banking system —where one bank cannot be "chained" to another programmatically without institutional agreements.

If you want the full catalog, we have it in DeFi Explained: Lending, Staking, Pools, Vaults, Yield Farming, and Derivatives.

What exactly does "permissionless" mean?

The slogan is catchy but opaque. It is worth breaking it down to the concrete operational difference between opening a position in a bank and opening the same position in a DeFi protocol.

In a bank, to open a savings account or apply for a loan, the typical process is: identify yourself (ID, proof of address), pass KYC and AML verification, wait for approval (hours to days), accept terms, depend on the bank's decision on whether to admit you or not, and operate within the bank's hours and jurisdiction. If the bank decides your profile doesn't fit, there is no operational appeal: you are out.

In DeFi, to open the same position: you install a wallet (five minutes), deposit tokens, connect to the protocol, and sign the transaction. There is no identification or approval. The protocol doesn't know who you are, nor does it care: the code executes for any address with valid tokens exactly the same way. It works at three in the morning on a Sunday and operates under the same set of rules for someone in Switzerland, Lagos, or Caracas.

That is what "permissionless" means: the protocol does not have a gatekeeper who can say "not you." The immediate consequence —universal access— is the central promise of the category. The less visible consequence is that the responsibility for any error lies entirely with you: if you take a loan you cannot repay, you are liquidated instantly without negotiation; if you sign a transaction incorrectly, there is no undo; if you choose the wrong protocol, no one will call you to ask if that's what you intended.

The operational freedom of DeFi is indistinguishable from operational responsibility. They are the same thing seen from two sides. This fits very well with profiles that value control and autonomy, and very poorly with profiles that prefer a service layer to rescue them from their own mistakes. Both preferences are legitimate.

Why are interest rates in DeFi different from those at the bank?

In a traditional bank, the rate you pay if you take a loan and the rate you earn if you deposit are set by the entity. Between the two is a margin (the spread) that covers operational costs and the bank's profit. In Spain, in 2026, a high-yield account pays around 1.5-2.5% while a personal loan costs between 6% and 12%: the spread is several points.

In DeFi, there is no bank. The rate the borrower pays is exactly what the lender receives, minus a small protocol fee. This symmetry —combined with global liquidity and composability— generates different dynamics:

• Higher rates on low-risk stablecoins. Depositing USDC in Aave in May 2026 typically pays between 3% and 6% annualized, compared to 1.5-2.5% in a bank account. The difference is that a bank returns your deposits guaranteed up to a certain limit by state insurance; the protocol does not.
• Much higher rates in specific strategies. Yield-bearing stablecoins like sUSDe (Ethena) have paid between 8% and 15% annualized depending on market conditions, in exchange for exposure to a delta-neutral mechanism with its own risks. Structured products on Pendle reach double-digit nominal yields with well-defined risk and terms.
• Negative rates at times. When a market inverts (more demand for withdrawal than deposit, temporary dislocations), rates can spike upward or crash within hours. Liquidity in DeFi is transparent and reactive, not rigid like that of a bank.

The reasonable conclusion: rates in DeFi are not "better" or "worse" than those at the bank — they are different markets with different trade-offs. Higher yield usually means more risk (protocol, oracle, mechanism). The naive equivalence "8% in DeFi is like 8% at the bank" ignores the nature of the product. To dive deeper with data by strategy, here is the concrete lending vs staking vs liquidity comparison; for a risk-adjusted reading (Sharpe), here.

What happens when something goes wrong in DeFi?

In the traditional banking system, there are layers of defense when something fails: deposit insurance up to a certain limit, customer service that can reverse fraudulent charges, regulators that intervene when a bank fails, and legal jurisdiction to claim against. In DeFi, there is none of that. It is best to know this before operating, not after.

The four most relevant failure categories:

• Smart contract risk. A bug in the protocol's code can drain it. The list of historical hacks totals billions of dollars. Audits reduce risk but do not eliminate it: practically all hacked protocols were audited.
• Oracle risk. Protocols need to know what each asset is worth to liquidate, lend, etc. These prices are provided by oracles (mostly Chainlink). If an oracle is manipulated or fails, the entire protocol operates on false data during that window. Oracle hacks have caused hundreds of millions in losses.
• Governance risk. Many protocols can be updated by a decision of their DAO or a multisig. A poorly coordinated governance decision or one captured by a hostile actor can change rules while your money is inside.
• Operator risk. Human error —signing the wrong transaction, approving overly broad permissions, sending tokens to the wrong address— is the most common cause of personal loss. There is no customer service to undo it.

None of these risks disqualify DeFi as a category; all four are manageable if understood. But pretending that "decentralized" means "risk-free" is exactly the mistake that has led to most of the painful losses in the category's short history. For an operational guide on personal security, Is DeFi Safe? — The Honest Answer with Data.

How "decentralized" is DeFi really?

Here is the uncomfortable point. The "decentralized" label suggests a total absence of central points of failure. The operational reality is more nuanced — and more fragile — than the marketing suggests.

A good part of DeFi in 2026 depends on infrastructure that is much more centralized than it appears. Approximately 90% of the ecosystem's validators and nodes run on three cloud providers (AWS, Google Cloud, Azure). The sequencers of the main L2s (Arbitrum, Base, Optimism) are currently operated by a single entity each. Price oracles are dominated by Chainlink, which is also a single point of failure if its network fails simultaneously. And most USDC and USDT live in the custody of two companies (Circle and Tether) that can technically freeze individual balances by court order.

This does not disqualify DeFi, but it lowers the level of the actual promise. "Decentralized" means, today, that there is no single intermediary in the financial flow — not that there are no intermediaries at all. The points of centralization are spread across the stack, are known to anyone who cares to look, and are a real constraint on the theoretical property of operational neutrality. We mapped this layer by layer in The Worst Risk in DeFi? — It's Not What You Think; the reading desensitizes but does not disqualify.

The real map of DeFi in 2026

Concepts settle better with concrete figures. Snapshot from May 2026:

Metric	Figure	Why it matters
Tether (USDT) — 2025 revenue	~$10,000M	Stablecoin issuer as the most profitable per capita business in the space
Hyperliquid — annualized revenue	$685M-$1,000M	Perpetuals DEX generating revenue comparable to a mid-sized bank
Pump.fun — 2025 revenue	$935M	An ephemeral token platform raised more than many serious protocols
Lido — assets under management	$27,600M	But the LDO token fell 96% — protocol revenue doesn't always reach the holder
Validators and nodes on 3 cloud providers	~90%	Real operational decentralization is much lower than conceptual decentralization
Stablecoins / total on-chain volume	~75%	What mostly moves through DeFi is tokenized dollars, not speculation

Three non-obvious takeaways from this map:

The real economy of DeFi is concentrated in a few very profitable businesses. Tether earning $10 billion a year competes with mid-sized real-world banks; Hyperliquid in a specific niche generates comparable income. Most other protocols don't come close, and most listed tokens are bets, not claims on real cash flows.

Just because a protocol makes money doesn't mean the token holder receives it. The case of Lido —$27,600M in assets under management and a token falling 96%— is the clearest example. The structure of value capture in the token is a separate question from whether the protocol is successful. The naive assumption "if the protocol grows, my token goes up" is structurally false in many cases. We break this down in The Real Revenue Ranking in DeFi 2026.

The true engine of adoption in 2026 is stablecoins, not speculation. Three-quarters of total DeFi volume is stablecoins moving as money. The popular narrative continues to look toward altcoin speculation; most real use is much more boring and much more sustainable.

Where to start (if you decide to start)?

Before any operational step, it is worth answering honestly:

1. Do you understand what a wallet is and the difference between self-custody and delegated custody? If not, that is the first lesson, not the first operation.
2. Are you willing to lose what you put in, even if you do everything right? Structural risks are not eliminated by personal care.
3. Does your current banking situation force you to use DeFi, or does it offer a reasonable alternative? If the latter, there is no urgency.
4. Do you have a concrete hypothesis of what you want to do (save, exchange, lend, speculate)? "Trying DeFi" in the abstract is the worst reason to enter.

If all the answers hold up, the next practical steps are:

• What is DeFi? — a pragmatic explainer parallel to this one, more focused on wallet mechanics, gas, and where to look at TVL.
• DeFi Explained — a product catalog with one-by-one descriptions (lending, staking, pools, vaults, derivatives, RWA).
• Is DeFi Safe? — the operational guide to personal security with concrete data.
• On-ramps Compared — how to get money into the ecosystem, real options, and costs.
• Why Crypto Might Not Be for You — the final check before moving a single euro.

And if after this complete series the conclusion is "no, this is not for me," that is also a valid decision and possibly the most reasonable one for a significant portion of readers. The operational utility of DeFi —like that of Bitcoin in Article 1— depends on the user's context, not a universal property. Knowing what it is, what it isn't, and why it exists is value in itself, even if you then decide to watch from the sidelines.

Sources and external references: DefiLlama — TVL and DeFi metrics · L2BEAT — L2 comparison and decentralization · Chainalysis — on-chain analysis