DeFi yield strategies: where the money comes from (and the hidden risks)

Scroll through any DeFi app and you'll see numbers that look unreal next to a savings account: 5 percent, 12 percent, sometimes 300 percent "APY". It's tempting to just sort by the highest number and hit deposit. Please don't.

A return with no clear source isn't a bargain; it's a risk you haven't found yet. The single most useful habit in DeFi is refusing to deposit until you can say, in one sentence, exactly what economic activity is paying you. This guide walks through the main sources of yield, roughly from simplest and safest to most complex and risky, with real numbers so you can see how they work.

First, what is DeFi?

DeFi, short for decentralized finance, means financial services like lending, borrowing and trading that run on smart contracts instead of through a bank or broker. You connect a wallet, interact with the contract directly, and the rules are enforced by code on a blockchain. If you want the mechanics, our tech guide explains smart contracts properly.

That setup has real upsides: it's open to anyone, it runs 24/7, and you can inspect the rules yourself. It also has real downsides: no customer support, no deposit insurance, and if the code has a bug, money can disappear in minutes.

APR vs APY: read the number properly

Before comparing yields, make sure you're comparing the same thing.

• APR (annual percentage rate) is the simple yearly rate, without counting interest earned on interest.
• APY (annual percentage yield) includes compounding, assuming your earnings are reinvested.

Source 1: Lending

You deposit an asset into a lending protocol. Borrowers post collateral and pay interest to borrow it. You get a share of that interest. This is the most legible yield in DeFi, and it's structurally similar to a bank paying interest on deposits, with three big differences: the "bank" is a smart contract, collateral rules are enforced automatically, and rates float in real time based on supply and demand.

How rates move

Most lending protocols set rates based on utilization: the share of deposits currently borrowed. When lots of people want to borrow and utilization is high, rates rise to attract more deposits and discourage borrowing. When utilization is low, rates fall. That's why your lending APY can jump or drop sharply in a day.

Why borrowers over-collateralize

DeFi lending doesn't check credit scores, so borrowers must lock up more value than they borrow. If their collateral drops too close to their loan value, the protocol liquidates it automatically to repay lenders. Many protocols show borrowers a "health factor": above 1 is safe, at or below 1 means liquidation.

Main risks for lenders: a bug or exploit in the smart contract; a collateral crash too fast for liquidations to keep up, leaving bad debt; a faulty price feed (oracle) triggering wrong liquidations; and temporary inability to withdraw when utilization is near 100 percent, because your deposit has been lent out.

Source 2: Liquidity provision

Decentralized exchanges don't use a traditional order book. Instead, users deposit pairs of tokens into a liquidity pool, and traders swap against that pool, paying a small fee each time. As a liquidity provider (LP), you earn a share of those fees in proportion to your share of the pool. You're basically running a tiny market-making business; your return depends on trading volume, not on anyone paying interest.

The big catch: impermanent loss

When the price of one token in the pair changes relative to the other, the pool automatically rebalances. It ends up holding more of the token that fell and less of the token that rose. Compared with simply holding both tokens in your wallet, you end up with less value. That gap is called impermanent loss. It's "impermanent" because it disappears if prices return to where they started, but if you withdraw while prices have moved, it's very real.

These figures are for a standard 50/50 pool. Pools of two stablecoins barely suffer impermanent loss (as long as both hold their pegs), which is why they're popular, though fees are lower too. "Concentrated liquidity" pools can earn more fees but amplify impermanent loss if price moves outside your chosen range.

Source 3: Staking

On proof-of-stake networks, staking means locking up the network's own token to help secure it. Validators who propose and confirm blocks earn newly issued tokens plus a share of transaction fees. On Ethereum, for example, running your own validator requires 32 ETH; most people instead delegate to a validator or use a staking service.

Staking yield is tied directly to the network's security model rather than to an app built on top. That makes it one of the more understandable yields, but it's paid in the network's own token, so if the token's price falls 50 percent, a 4 percent yield doesn't help much.

Liquid staking

Liquid staking services give you a token that represents your staked position, which you can trade or use elsewhere in DeFi. It's convenient, but it adds risks: the service's smart contracts, and the chance that the liquid token trades below the value of what it represents.

Main risks: slashing (an automatic penalty that can take part of a validator's stake if it misbehaves, and sometimes its delegators' too); lock-up or unstaking periods that stop you exiting quickly; and price risk on the token itself.

Source 4: Token incentives ("farming")

Many of the highest yields come from protocols paying users in their own newly created tokens to attract deposits. This is often called liquidity mining or yield farming. It can be real money if you sell the rewards, but it's important to understand what's happening: the protocol is effectively diluting existing token holders to pay you.

These rates are usually temporary. When the incentive program ends, or when everyone farming the token sells it and the price drops, the yield shrinks fast. A 200 percent APY paid in a token that falls 90 percent isn't 200 percent.

Layered and leveraged strategies

Some strategies combine everything: deposit an asset as collateral, borrow against it, put the borrowed money into another yield source, and repeat across several protocols. These "loops" can multiply the headline number.

The full risk list

Smart contract risk

Bugs or exploits that let attackers drain funds. Audits reduce this risk but don't remove it.

Oracle risk

Protocols rely on price feeds. A wrong or manipulated price can trigger unfair liquidations or let attackers borrow too much.

Stablecoin risk

Many pools and loans use stablecoins. If one loses its peg, everything built on it is affected. See stablecoins explained.

Bridge risk

Tokens moved between blockchains rely on bridges, which have been some of the most hacked systems in crypto.

Governance risk

Token holders can vote to change a protocol's rules, fees or collateral settings, sometimes in ways that hurt depositors.

Rug pulls

Some projects are scams from day one, with developers able to withdraw users' funds. Anonymous teams, unaudited code and huge yields are a common combination.

Regulatory risk

Rules for DeFi are still developing in many countries and could affect which apps you can use.

A framework for any yield

Run through these in order before you deposit anything.

1. Name the source

   Borrower interest, trading fees, staking rewards, or new token emissions? These aren't equally durable.

2. Check whether it's subsidized

   If rewards are paid in the protocol's own new token, ask what happens to the yield when incentives end or that token's price falls.

3. Count the contracts

   Every additional protocol is another point of failure.

4. Look at the track record

   How long has the protocol run, how much does it hold, has it been audited, and has it been exploited before? On-chain data can help; see our on-chain analysis guide.

5. Understand your exit

   Lock-ups, withdrawal queues and impermanent loss can all mean what you can actually withdraw differs from what the dashboard shows.

6. Start small

   Test with an amount you can afford to lose before committing more.

Red flags

• Yields far above anything comparable, with no clear explanation of where they come from.
• An anonymous team, no audits, and code that hasn't been published.
• Pressure to deposit quickly ("only 2 hours left!").
• A website or link sent to you in a direct message. Fake DeFi sites are a common way to steal funds.
• Being asked to approve unlimited token spending for something that shouldn't need it.

DeFi yields well above what comparable lending or fee-generating activity would suggest are almost always paying you for a specific risk. That doesn't make every high yield a trap. It does mean the size of the number tells you nothing on its own. Only the source does.

This article is general education about how things work. It is not financial, investment or tax advice, and it doesn't consider your circumstances. Do your own research and talk to a licensed professional before making decisions with money.