DeFi Protocols: An Advanced, High-Risk Corner of Crypto

Risk Warning: Decentralised finance is an advanced, experimental and high-risk activity within an asset class — cryptocurrency — that is itself highly volatile and largely unregulated for UK retail investors. Funds committed to DeFi protocols are not covered by the Financial Services Compensation Scheme (FSCS) and fall outside the Financial Ombudsman Service (FOS). Smart contract failures, fraud and token collapses have repeatedly caused total, unrecoverable losses. All capital committed is at risk and may be lost entirely.

---

Decentralised finance — DeFi — is the ecosystem of financial services built as self-executing code on blockchains: lending and borrowing, token exchange, liquidity provision and yield generation, all conducted through smart contracts rather than banks, brokers or exchanges. Its advocates describe it as finance rebuilt without intermediaries. That description is accurate, and it cuts both ways: DeFi also operates without the capital requirements, conduct rules, compensation schemes and legal recourse that intermediated finance provides.

This guide should be read as an explicitly advanced briefing, not an invitation. DeFi is among the highest-risk activities available to any investor. Several protocols have collapsed outright, exploits of smart contract code have cost users billions, and the sector's history includes fraud on an industrial scale. For most investors — including most sophisticated ones — the appropriate DeFi allocation is zero, and nothing here should be read as a recommendation to participate. The purpose of this guide is to explain how the machinery works and precisely where it has broken, so that anyone who encounters DeFi — including through unsolicited approaches, which are a common fraud vector — understands what they are looking at.

DeFi presupposes everything covered in our guide to direct ownership, custody and security: interacting with protocols means transacting from a self-custodied wallet, with every irreversibility that entails. The prior question of whether crypto belongs in a portfolio at all is addressed in our rational framework for crypto assets.

What DeFi Protocols Actually Do

The core DeFi building blocks mirror conventional financial functions, re-implemented as code.

Decentralised exchanges (DEXs) let users swap one token for another directly from their own wallets. Most use an automated market maker design: instead of an order book matching buyers and sellers, a pool of two tokens sets prices algorithmically from the ratio of assets it holds, and traders swap against the pool. Uniswap is the widely cited example.

Liquidity provision is the other side of that trade. The pools need assets, so protocols invite users to deposit token pairs, issuing LP (liquidity provider) tokens that represent the deposited share. Providers earn a fraction of the trading fees the pool generates — and take on impermanent loss, described below.

Lending protocols pool deposits of one token and lend them to borrowers who post other tokens as collateral, with interest rates set algorithmically by supply and demand and positions liquidated automatically if collateral values fall too far.

Yield farming is the practice of moving assets between protocols to chase reward incentives, often paid in a protocol's own newly created token. It is the most aggressively marketed corner of DeFi and the one most densely populated by unsustainable schemes: rewards paid in a token whose value depends on new participants arriving have a familiar structure, and DeFi yields are often attractive precisely because the risks are high.

Everything above runs on smart contracts holding pooled user funds — which is where the risk analysis has to begin.

Smart Contract Risk: The Code Is the Counterparty

In conventional finance, a failed counterparty can be sued, wound up, or covered by a compensation scheme. In DeFi the counterparty is code. If a smart contract contains an error or vulnerability, an attacker may be able to drain every asset it controls, and because blockchain transactions are irreversible, recovery is rare. Exploits and hacks of smart contract code have cost users billions across the sector's history; the 2022 Ronin Network bridge theft of approximately USD 620 million — attributed to a state-linked hacking group — illustrates the scale a single incident can reach.

Independent code audits are the sector's main quality signal, and a protocol that has never been audited should be treated as uninvestable even by DeFi's own standards. But audits are a floor, not a guarantee: audited protocols have been successfully exploited, because an audit examines the code that exists at one moment against the attacks its reviewers can foresee. Established protocols with long operating histories, multiple audits and large bug-bounty programmes are meaningfully safer than new ones — and still not safe in any conventional sense.

Impermanent Loss: The Liquidity Provider's Hidden Cost

Impermanent loss is the least intuitive of DeFi's risks and catches out many otherwise careful participants. An automated market maker pool continuously rebalances between its two assets as their relative price moves: arbitrage traders buy the appreciating asset out of the pool and sell the depreciating one into it. The mechanical consequence for a liquidity provider is that their pool share drifts toward holding more of the asset that fell and less of the asset that rose.

The result: when the provider withdraws, the position can be worth less than if they had simply held the two assets in a wallet and done nothing. The gap is called "impermanent" because it fluctuates with prices and would close if relative prices returned to their starting point — but it becomes entirely permanent the moment the provider withdraws. Trading fee income is meant to compensate for this drag, and in stable, high-volume pools it sometimes does. When the two assets' prices diverge sharply — the normal condition in crypto markets — it frequently does not. Any evaluation of a pool's advertised yield that ignores impermanent loss is measuring the gross and ignoring the cost.

Rug Pulls and Fraud: An Ecosystem Problem

The same properties that make DeFi permissionless — anyone can deploy a token or protocol, anonymously, with no listing standards — make it a natural habitat for exit fraud. In a rug pull, a team launches a token or yield scheme, attracts deposits, then drains the funds: selling a dominant token holding into the market, withdrawing the pooled liquidity that made the token tradeable, or simply using privileged administrative keys written into the contract to take everything. The collapse of TerraUSD in 2022 — a supposedly stable USD-pegged token whose failure wiped out approximately $40 billion in value within days and brought down the wider Terra/LUNA ecosystem — was not a classic rug pull, but it demonstrated how quickly a flawed protocol design can convert billions of apparently stable value into nothing.

Fraud in this ecosystem also arrives from outside the protocols themselves. Organised scams recruit victims through messaging groups and social media, walk them through connecting a wallet to a fake "liquidity mining" platform, and drain it — a pattern documented first-hand in our account of a DeFi liquidity mining scam operating through WhatsApp, which promised implausible daily returns and harvested wallets at scale. The reliable markers recur across both categories: anonymous teams, unaudited contracts, token supply concentrated in a few wallets, pressure to act quickly, and yields no legitimate mechanism could sustain.

Oracle Manipulation and Protocol Design Risk

DeFi protocols cannot see the outside world; they rely on oracles — data feeds that report asset prices onto the blockchain. A lending protocol deciding whether a loan is adequately collateralised is only as sound as the price feed it consults. Attackers have repeatedly exploited this: by manipulating a thinly traded market that an oracle reads, they can make a protocol believe collateral is worth far more or less than it is, then borrow against the distortion or trigger artificial liquidations.

Beyond oracles, protocol design itself is a risk surface. Governance tokens can concentrate control in few hands; upgradeable contracts mean the code you evaluated may not be the code that holds your funds next month; and protocols compose with one another, so a failure in one contract can cascade through others built on top of it. These are risks with no analogue in conventional investing, and evaluating them requires genuine technical depth — which is the honest test of whether DeFi participation is appropriate: an investor who cannot independently assess these mechanisms has no basis for taking the risk.

No Regulator, No Compensation, Unsettled Tax

DeFi protocols are unregulated software, not authorised firms. For UK retail investors the position is stark: cryptoassets are largely unregulated, funds committed to DeFi carry no FSCS cover, there is no FOS jurisdiction, and there is usually no identifiable legal counterparty to pursue when things fail. The UK's financial promotions regime has applied to crypto marketing since October 2023, and the government intends to bring core crypto activities within the regulated activities framework — but no current or proposed framework turns an anonymous offshore protocol into a protected investment.

The tax treatment is correspondingly unsettled. Swapping tokens on a DEX is generally a CGT disposal like any other crypto swap; yield farming rewards are generally income at the value received; but whether depositing assets into a liquidity pool is itself a disposal — and how LP tokens should be characterised — has not been fully clarified by HMRC, which has committed to further DeFi-specific guidance. Anyone with meaningful DeFi activity needs granular transaction records and specialist advice; our cryptocurrency tax guide for international investors covers the wider landscape.

Where DeFi Sits in the Risk Spectrum

Set DeFi against the other routes described in this series and the tiering becomes clear. Direct ownership of Bitcoin or Ethereum carries price and custody risk. Staking adds lock-up, slashing and platform risk on top. DeFi adds smart contract risk, impermanent loss, oracle manipulation and an elevated fraud environment on top of all of that — a genuinely different tier, which is why this guide is framed as advanced and why the crypto assets investment framework treats DeFi and most altcoins as unsuitable for core allocations of any size. For the few technically expert investors who participate at all, the sector's own norms point to fully audited, long-established protocols, position sizes that assume total loss, and complete separation from capital that matters.

How Global Investments Can Help

Global Investments does not provide access to DeFi protocols and does not recommend DeFi participation. Our investment team's role here is defensive and integrative: helping clients understand what they hold if they have existing DeFi positions, how those positions should be reported across jurisdictions, and how to unwind or contain exposure that no longer fits their risk profile. We also help clients evaluate unsolicited crypto "opportunities" — a category in which fraud is endemic — before any funds move. If any of that applies to you, contact us.

---

This guide is for information and education only and does not constitute a personal recommendation or regulated investment advice. Decentralised finance is an advanced, experimental, high-risk activity: smart contract failures, fraud and token collapses have repeatedly caused total losses. Cryptocurrency is largely unregulated for UK retail investors; assets committed to DeFi protocols are not covered by the FSCS and fall outside the FOS. The value of cryptoassets can fall rapidly and may fall to zero — all capital committed is at risk. Tax treatment of DeFi activity is evolving and depends on individual circumstances and jurisdiction. Seek independent professional advice before investing.