What Is Ethereum DeFi and How Does It Work in 2026?

What DeFi Is and How It Differs from a Centralised Exchange

A centralised exchange (CEX) like Coinbase or Kraken is a company. You deposit funds, the company holds your private keys, and you have a credit on their internal ledger. The risks are well-documented: exchange insolvency, regulatory seizure, withdrawal freezes. FTX collapsed in November 2022, vaporising approximately $8 billion in customer funds in 72 hours — not because of a blockchain failure, but because a company misused deposits.

DeFi removes the company from the equation entirely. Smart contracts — self-executing code deployed on Ethereum — hold the assets and enforce the rules. When you use Uniswap to swap ETH for USDC, you interact directly with a contract; no exchange employee approves the trade, holds your funds, or can freeze your account. You keep your private keys throughout. The risk profile shifts: instead of counterparty risk (will the company stay solvent?), you face protocol risk (is the code secure?).

This distinction is structural, not cosmetic. A CEX failure is an institutional failure; a DeFi exploit is a software failure. Both are serious, but the mechanisms — and the mitigations — are entirely different. Understanding which risk you are taking is the prerequisite for participating in either system.

• CEX: exchange holds your keys; you have a credit, not direct asset ownership
• DeFi: you hold your keys; the smart contract executes the trade on your behalf
• CEX risks: insolvency, hack of hot wallets, regulatory seizure, withdrawal freeze
• DeFi risks: smart contract exploit, oracle manipulation, impermanent loss, rug pull
• TVL (Total Value Locked) is the primary metric for DeFi ecosystem health — the aggregate value of assets deposited into DeFi protocols at any given time

The Core Protocols: Uniswap, Aave, Compound, and Curve

Uniswap is the largest decentralised exchange by trading volume and the protocol most synonymous with DeFi itself. It operates as an Automated Market Maker (AMM): instead of a traditional order book matching buyers and sellers, liquidity providers deposit token pairs into pools, and the contract's constant-product formula (x × y = k) determines prices. Uniswap v3 introduced concentrated liquidity, allowing providers to specify price ranges — the same capital deployed in a narrow range generates far higher fee income than spread across the full curve, but it earns nothing when the price moves outside that range. Fee tiers are 0.01%, 0.05%, 0.30%, and 1%, calibrated to the volatility of each trading pair.

Aave is Ethereum's leading lending protocol. Depositors supply assets — ETH, USDC, WBTC — to earn a variable interest rate paid by borrowers. Borrowers must post collateral worth more than the loan (over-collateralisation, typically at a 75–80% loan-to-value ratio). If the collateral value falls below the liquidation threshold, the position is liquidated automatically by the contract. Aave v3 added efficiency mode (higher LTV for correlated assets like USDC and USDT) and cross-chain deployments across Arbitrum, Polygon, Optimism, and Base. Compound operates on a similar model and was historically the first major lending protocol, though Aave has grown to hold the larger TVL. Verify current rates directly on each protocol — they fluctuate with supply and demand and cannot be stated as fixed figures in evergreen content.

Curve Finance is optimised specifically for swapping between assets that should trade at near-parity: stablecoin pairs (USDC/USDT, USDC/DAI) and liquid staking tokens (stETH/ETH). Its StableSwap invariant formula produces dramatically lower slippage than Uniswap's constant-product model for these pairs. Curve's governance is notably complex: the veCRV (vote-escrowed CRV) system allows token holders to lock CRV for up to four years in exchange for boosted yields and voting rights over which pools receive emissions. Understanding Curve requires understanding this incentive layer, not just the AMM mechanics.

• Uniswap: AMM DEX, largest by volume, fee tiers 0.01–1%, concentrated liquidity in v3
• Aave: over-collateralised lending and borrowing; deposit ETH, borrow USDC against it
• Compound: similar model to Aave; historically the pioneer of on-chain money markets
• Curve Finance: stablecoin-optimised AMM, minimal slippage on correlated pairs, veCRV governance
• TVL across all Ethereum DeFi protocols: check DeFiLlama (defillama.com) for current figures — never rely on hardcoded numbers

Smart Contract Risk: The Exploits You Need to Know

Smart contracts are immutable once deployed — their code cannot be patched in the way a traditional software application can. When a vulnerability exists, the attacker typically has a window of minutes to drain the protocol before governance can vote to pause it. The exploit record for DeFi and adjacent crypto infrastructure is not a theoretical concern; it is a documented and ongoing pattern.

The Ronin Bridge — the bridge serving Axie Infinity's Ethereum sidechain — was exploited in March 2022 for approximately $625 million (USD at the time). Attackers compromised five of nine validator keys through a combination of social engineering and a malicious PDF. The funds were held in the bridge contract; once the keys were obtained, the attacker simply authorised a withdrawal. The lesson is that multi-signature security is only as strong as the key management behind it. The Wormhole bridge connecting Solana to Ethereum was drained for approximately $320 million in February 2022 through a flaw in Solana's signature verification logic. Euler Finance, a lending protocol on Ethereum, suffered a flash loan attack in March 2023 resulting in approximately $197 million in losses — the attacker exploited a flaw in Euler's donation mechanism to create an undercollateralised position that was then liquidated at profit. Euler subsequently recovered most funds through negotiation, an unusual outcome.

These are not outliers in an otherwise-safe environment. They are characteristic of a class of systems where the attack surface is the public code itself, financial incentives are very large, and exploits are irreversible. The appropriate response is not to avoid DeFi categorically, but to understand the risk, limit exposure relative to your overall portfolio, prefer protocols with long audit histories and no prior exploits, and never deposit funds you cannot afford to lose entirely.

• Ronin Bridge: ~$625M, March 2022 — validator key compromise via social engineering
• Wormhole Bridge: ~$320M, February 2022 — Solana signature verification vulnerability
• Euler Finance: ~$197M, March 2023 — flash loan attack on donation mechanism; most funds later recovered
• Oracle manipulation: attackers use flash loans to distort price feeds, then exploit protocols relying on those prices
• Rug pulls: anonymous teams deploy a protocol, attract liquidity, then drain the contracts — no recourse
• Mitigations: audit history (Trail of Bits, OpenZeppelin, Certora), bug bounty programmes, protocol age, TVL stability over time

Impermanent Loss: What Liquidity Providers Actually Earn

Impermanent loss (IL) is the opportunity cost of providing liquidity to an AMM pool relative to simply holding the same assets. It arises because the AMM constantly rebalances the pool to maintain the constant-product invariant — which means as one asset appreciates, the pool automatically sells some of it and buys the other. The LP ends up with less of the appreciating asset than if they had held it directly.

A concrete example: suppose you deposit 1 ETH and 2,000 USDC into a Uniswap pool when ETH is worth £2,000. ETH subsequently rises to £3,000. The pool rebalances: you now hold approximately 0.82 ETH and 2,449 USDC — a total value of roughly £4,910. Had you simply held 1 ETH and 2,000 USDC, you would have £5,000. The difference — £90, or about 1.8% — is impermanent loss. The loss is 'impermanent' only if ETH returns to £2,000; if ETH continues rising, the loss relative to holding becomes larger and more permanent. Fee income from the pool may or may not compensate for this loss, depending on trading volume.

Impermanent loss is lowest — effectively zero — for stablecoin pairs such as USDC/USDT, because the assets do not diverge in price. It is highest for volatile pairs such as ETH/BTC or ETH/altcoin. Uniswap v3's concentrated liquidity amplifies both fee income and IL: narrower ranges earn more fees per unit of capital but suffer greater impermanent loss from the same price movement. Single-sided strategies (such as Lido's liquid staking, where you deposit ETH and receive stETH) avoid impermanent loss entirely because no second asset is involved. Before providing liquidity to any pool, use an IL calculator with realistic price-divergence scenarios — not just the optimistic flat-price scenario.

• IL is the gap between holding assets outright and providing them as liquidity in an AMM
• IL increases with price divergence between the two pooled assets
• Stablecoin pools (USDC/USDT) have near-zero IL; volatile pairs (ETH/altcoin) have the highest IL
• Uniswap v3 concentrated liquidity amplifies both fee income and IL — narrower ranges = higher risk
• IL is 'impermanent' only if prices return to the deposit ratio; in practice, directional moves make it permanent
• Fee income may offset IL in high-volume pools — but this is not guaranteed and must be modelled per pool

Gas Fees and Layer 2 Solutions: Making DeFi Economical

Ethereum's Layer 1 (mainnet) charges gas fees for every transaction — the price you pay to have validators process and confirm your interaction with a smart contract. Gas fees are denominated in ETH and fluctuate with network demand. During periods of high activity, a single Uniswap swap on Ethereum mainnet can cost $20–$100 or more in gas, regardless of the size of your trade. For a £500 DeFi transaction, a £60 gas fee represents a 12% cost before you have even considered slippage or protocol fees — making small transactions on L1 economically irrational.

Layer 2 (L2) rollups solve this by executing transactions off-chain and posting compressed batches to Ethereum mainnet for security. Arbitrum One and Optimism are optimistic rollups: they assume transactions are valid and allow a 7-day challenge window before finality. Coinbase's Base chain is built on the OP Stack (the same architecture as Optimism) and has grown rapidly due to Coinbase's distribution. ZK rollups (zkSync, StarkNet, Polygon zkEVM, Linea) use cryptographic proofs to verify batches, achieving finality in roughly one to two hours with no challenge window. All major DeFi protocols — Uniswap, Aave, Curve — are deployed on the leading L2s. Gas fees on L2s are typically £0.01–£0.50 per transaction rather than £20–£100 on mainnet.

The important caveat on L2 withdrawals: moving funds from an L2 back to Ethereum mainnet is not instantaneous. Optimistic rollups require the full 7-day challenge window to withdraw via the official bridge. Third-party bridges (Across, Stargate) can bypass this with faster settlement (5–15 minutes) by using their own liquidity pools, but they introduce additional counterparty risk. For most retail DeFi users in 2026, the practical path is: buy ETH on a regulated exchange (Coinbase, Kraken), withdraw to a self-custody wallet (MetaMask), bridge to Arbitrum or Base, and interact with DeFi protocols there at a fraction of the L1 cost. Verify current gas prices at L2Fees (l2fees.info) before transacting — rates change with network conditions.

• Ethereum L1 gas fees: $20–$100+ per transaction during peak demand — uneconomical for small trades
• Arbitrum One: largest L2 by TVL; optimistic rollup; 7-day withdrawal to L1 via native bridge
• Optimism / Base (OP Stack): second-largest ecosystem; Coinbase's Base has grown fastest in 2024–2026
• ZK rollups (zkSync, StarkNet, Linea): cryptographic proof settlement, ~1–2 hours finality, no 7-day window
• L2 gas fees: typically £0.01–£0.50 per transaction — check l2fees.info for live rates
• All major DeFi protocols (Uniswap, Aave, Curve) are fully deployed on leading L2s
• Third-party bridges are faster but carry additional smart contract and validator risk vs native bridges

Stablecoins in DeFi: USDC, USDT, and the MiCA Divide

Stablecoins are the engine of DeFi liquidity — the assets you borrow, the assets you park yield in, and the assets you route through when exiting volatile positions. Understanding which stablecoins you are using, and their distinct risk profiles, is not optional for DeFi participants.

USDT (Tether) is the most liquid stablecoin by trading volume and is present on virtually every DeFi protocol and chain. Tether publishes monthly reserve attestations — not full audits — showing reserves of approximately 70% fiat-equivalent instruments and 30% short-term bonds, with no single regulated bank as a named custodian in the same way USDC operates. Tether has not obtained authorisation under the EU's MiCA regulation (Markets in Crypto-Assets), which requires stablecoin issuers to hold a licence from an EU National Competent Authority. As a result, EU-licensed exchanges began delisting or restricting USDT pairs for EU retail customers in late 2024. USDT has not experienced a systemic de-peg, but its reserve structure and regulatory position are materially different from USDC and this distinction matters for risk assessment.

USDC (Circle) obtained an Electronic Money Institution (EMI) licence in France, making it a MiCA-compliant Electronic Money Token. Its reserves are held in US dollar deposits and short-term US Treasury holdings with regulated custodians. USDC did experience a brief de-peg to approximately $0.88 in March 2023 during the Silicon Valley Bank collapse, when Circle disclosed that $3.3 billion of USDC reserves were held at SVB. The peg recovered within hours after the US Federal Reserve backstopped depositors — demonstrating that even the highest-quality stablecoin is not immune to custodian risk, but that Circle's institutional structure enabled a rapid resolution. For UK users, the FCA has not yet issued definitive stablecoin authorisation frameworks equivalent to MiCA; check the FCA register directly for the current status of any stablecoin or issuer you are using.

• USDT: most liquid, monthly attestations (not full audits), ~70% fiat / ~30% bonds, MiCA non-compliant
• USDC: MiCA-compliant EMT, regulated custodians, brief $0.88 de-peg during SVB collapse (March 2023) — recovered within hours
• EURC (Circle): euro-denominated, MiCA-compliant, growing in EU DeFi contexts
• DAI (MakerDAO): over-collateralised, algorithmically managed, regulatory grey zone under MiCA
• UK users: FCA has not issued MiCA-equivalent stablecoin rules as at mid-2026 — verify directly at fca.org.uk
• EU exchanges began restricting USDT for retail clients under MiCA from late 2024 — verify current availability on your exchange

UK Regulatory Context: FCA Rules and What They Mean for DeFi

The UK is not subject to the EU's MiCA regulation following Brexit — do not assume parity. The Financial Conduct Authority (FCA) is the relevant regulator for UK participants, and its approach to DeFi and crypto more broadly has been characterised by caution, incremental guidance, and a hard ban on specific product categories.

The FCA banned the sale of crypto derivatives — including contracts for difference (CFDs) and options — to retail clients in January 2021. This means that UK retail participants cannot legally access leveraged perpetual futures or options on crypto assets through UK-regulated channels. Offshore platforms (Binance, Bybit, Hyperliquid) operate outside this restriction and continue to serve UK users, but they do so in a regulatory grey zone — the FCA has repeatedly warned consumers that funds held on unregistered platforms have no FSCS protection and no FCA redress route.

On-chain DeFi protocols — Uniswap, Aave, Curve — are not themselves FCA-regulated, because there is no operator entity to regulate; the contracts are autonomous code. However, the front-end interfaces to these protocols (websites, apps) can be geographically restricted, and the FCA's financial promotions regime (effective October 2023) requires that crypto promotions in the UK are approved by an FCA-authorised firm, clearly risk-warned, and not misleading. Any site serving UK users that describes DeFi yields without appropriate risk warnings is potentially in breach of UK financial promotions rules. For UK DeFi participants, the practical advice is: use a self-custody wallet to interact with protocols directly (MetaMask, Ledger), verify that any centralised element in your workflow (exchange, on-ramp) is FCA-registered or authorised, and treat offshore perpetuals platforms as unregulated — because they are.

• FCA banned retail crypto derivatives (CFDs, options) in January 2021 — hard restriction, still in force
• UK financial promotions regime (October 2023): crypto marketing to UK users must include clear risk warnings
• DeFi protocols are not FCA-regulated (no operator entity), but front-ends can restrict UK access
• FSCS protection does not apply to unregistered crypto platforms — no recourse if funds are lost
• MiCA does not apply to UK users post-Brexit — FCA rules govern; check fca.org.uk for current guidance
• On-ramps: use FCA-registered or FCA-authorised exchanges for fiat-to-crypto conversion (Coinbase, Kraken both hold UK registrations — verify current status)

Sources & further reading

• DeFiLlama — DeFi TVL and Protocol Data
• Uniswap Protocol Documentation
• Aave Protocol Documentation
• Curve Finance Documentation
• L2Beat — Layer 2 Security Assessments
• L2Fees — Live Layer 2 Gas Comparison
• FCA Cryptoasset Register
• HMRC Cryptoassets Manual
• Ronin Bridge Exploit Post-Mortem (Ronin Network)
• Euler Finance Exploit Disclosure
• Circle USDC Reserve Transparency Dashboard
• ESMA CASP Register (MiCA)