What are the risks of DeFi?

How do DeFi risks map to the risks you already know from traditional finance?

DeFi risk is different from traditional financial risk, but it is visible and it is manageable, and most of it maps onto categories an investor already understands. Smart contract risk is technology and operational risk: the system that holds the assets can fail. Impermanent loss is inventory risk, the same exposure a market maker carries when it holds both sides of a trade. Rug pulls are fraud. Governance attacks are a control failure, the on-chain equivalent of a board being captured. Regulatory risk is regulatory risk.

What is different is where the risk sits and who absorbs it. In traditional finance, an intermediary holds the assets and a regulator, an insurer or a court stands behind the intermediary. In DeFi, a smart contract holds the assets and nothing stands behind the contract except its code and its track record. According to Chainalysis, DeFi protocols accounted for the majority of crypto theft in 2022 and 2023. That is the cost of removing the intermediary. The rest of this guide takes each category in turn, with the incidents that defined it and the questions that surface it before you deposit.

What is smart contract risk?

A smart contract is code that holds assets and executes rules automatically. Smart contract risk is the chance that the code does something its authors did not intend, and that someone exploits it before it is fixed. Because the contract holds the funds directly, a successful exploit usually means the funds are gone. There is no chargeback and often no legal recourse.

Two 2023 incidents show the range. In March 2023, Euler Finance, an audited lending protocol, was drained through a flaw in its donation and liquidation logic; most funds were later returned by the attacker, which is unusual. In July 2023, several Curve Finance liquidity pools lost funds because of a bug in specific versions of the Vyper compiler used to build them. The Curve contracts themselves had been audited. The flaw sat one layer down, in the tooling.

That is the lesson. Audits reduce risk but cannot certify the absence of bugs, and risk can live in dependencies a protocol did not write. Time in production with large balances at stake is the closest thing DeFi has to a safety record, and even that is not a guarantee.

What is impermanent loss?

Impermanent loss is the gap between what a liquidity provider's deposit is worth and what the same assets would be worth if they had simply been held. It happens because an automated market maker constantly rebalances the pool as prices move. When one asset rises relative to the other, the pool sells the rising asset to buyers and accumulates the falling one. You end up holding more of what went down and less of what went up.

The loss is called impermanent because it disappears if prices return to where they started. In practice they often do not. The size of the loss grows with the size of the price divergence, so a large move in one asset relative to the other produces a meaningful shortfall versus holding, before fees. Trading fees earned by the pool are meant to compensate for this. In volatile pairs, they frequently do not.

Stablecoin-to-stablecoin pools carry very little impermanent loss because the assets are meant to hold the same price. Pools pairing a volatile token with a stablecoin carry far more. Reading a pool's advertised yield without estimating its impermanent loss is a common mistake in DeFi.

What are rug pulls and governance attacks?

A rug pull is theft by the people who built the project. A team launches a token or protocol, markets a high yield, attracts deposits, and then removes the liquidity or drains the contracts using privileges they kept for themselves. The Squid Game token in November 2021 is a well-known example: the code prevented holders from selling while the creators cashed out. Rug pulls are common among unaudited forks of established protocols that promise higher returns than the original.

A governance attack uses a protocol's own voting system against it. Many protocols let token holders vote on changes, including changes to where treasury funds go. An attacker who acquires or borrows enough voting power can pass a proposal that transfers assets to themselves. In April 2022, Beanstalk Farms was drained in a single transaction when an attacker borrowed voting tokens, passed a malicious proposal and repaid the loan, all within seconds.

Both categories share a root cause: someone holds a privilege that can move depositor funds without a delay. In a rug pull the privilege belongs to the team; in a governance attack it belongs to whoever can assemble the votes before anyone else reacts. The defenses are the same, and the next section lists them.

What are the warning signs of a protocol you should avoid?

Warning signs are consistent across the incidents above. Anonymous teams with unlocked token allocations. Admin keys that can change contracts without delay. Yields that cannot be traced to a payer. Governance with no time lock between a vote passing and its execution. None of these alone is proof of fraud. Several together are a reason to walk away.

Add the lessons from the exploit record. An audit is a point-in-time review by a security firm; good audits catch many flaws and are a reasonable minimum standard, but Euler Finance had been audited before its March 2023 exploit and the Curve Finance losses in July 2023 came from a compiler bug outside the audited code. Treat multiple audits plus a long production history as evidence, not proof. Prefer protocols that have held large balances through market stress. Prefer stablecoin pairs if you are providing liquidity. Avoid unaudited forks and any yield you cannot explain in one sentence, naming who pays it and why. Limit exposure to any single contract to an amount you could lose outright.

How does regulatory risk affect DeFi?

DeFi protocols run on global networks, but their users, developers and front ends live in specific jurisdictions. That mismatch is the source of regulatory risk. A protocol can be legal to use in one country and restricted in another. A developer can be prosecuted for code that continues to run without them, as the Tornado Cash cases in the United States and the Netherlands showed.

For investors, the practical risks are access and classification. A front end can be geo-blocked or taken down, leaving funds recoverable only by interacting with the contracts directly. A token you hold can be deemed a security, which changes where it can trade and how it is taxed. Stablecoin rules in the United States were clarified by federal legislation in 2025, which reduced one source of uncertainty, but rules for lending, trading and yield protocols are still developing.

Regulated access points work inside this uncertainty rather than around it. An SEC-registered adviser deploying client assets into DeFi is subject to adviser, custody and reporting rules today, whatever happens at the protocol level tomorrow. That does not protect against a protocol being shut down. It does mean someone with a fiduciary duty is watching for it.

How do managed strategies reduce DeFi risk?

A managed strategy puts a research process between your capital and the protocol. At Abra that process starts with protocol selection: how long the code has been live, how much value it has secured through stress, who audited it and when, whether admin keys are time-locked or multi-signature, and whether the yield can be traced to a real payer. Protocols that fail those screens are not used, however attractive the rate.

It continues with sizing and monitoring. Exposure to any single protocol is limited, positions are watched continuously, and strategies are unwound when conditions change. Assets that are not deployed sit in your separately managed account at Fireblocks Trust Company, LLC with Fireblocks MPC key management, and Abra does not rehypothecate. That last point matters because rehypothecation, not smart contract failure, was the root cause of the 2022 collapses at Celsius, Voyager Digital and BlockFi. The Abra explainer on rehypothecation covers why.

What a managed strategy does not do is make smart contract risk disappear. If a selected protocol is exploited, the strategy takes the loss. The value of management is fewer bad protocols, smaller concentrations and faster reaction, inside a regulatory wrapper with a fiduciary duty to you.

Should you use DeFi directly or through a managed platform?

Direct use suits investors who can read a smart contract or at least a security audit, who are comfortable managing keys and gas, and who have time to monitor positions. The benefits are full control, no advisory fee, and access to every protocol, including new ones a manager would not touch. The cost is that every DeFi risk described above lands on you alone.

A managed platform suits investors who want DeFi return sources in a portfolio without making DeFi a second job. You give up some control and pay a fee. You gain professional protocol selection, position limits, continuous monitoring, custody that keeps undeployed assets segregated, and consolidated reporting for tax and estate purposes. For a high-net-worth portfolio, that reporting alone is often decisive.

Many experienced investors do both: a small self-directed allocation for protocols they want to understand firsthand, and a larger managed allocation for the return sources they want to hold at scale. Whichever route you take, the questions are the same. Who is paying the yield, what can break, and where do the assets sit while they earn.