Decentralised finance — DeFi — has survived its first real crisis. The collapse of FTX, the Terra/Luna implosion, dozens of bridge hacks and a brutal bear market that slashed total value locked (TVL) from a peak of $180 billion in late 2021 to below $40 billion in late 2022. Yet by early 2025, DeFi TVL had climbed back to $120 billion, with trading volumes and revenue generation approaching all-time highs.
According to DefiLlama, the three largest DeFi protocols by TVL are Lido (liquid staking, $35 billion), Aave (lending, $12 billion) and Uniswap (decentralised exchange, $8 billion). Between them, they generate over $1.5 billion in annualised fee revenue — real economic activity, not just token speculation. Uniswap alone processed over $600 billion in trading volume in 2024, putting it on par with Coinbase, the largest US-based centralised exchange.
But the risks have not gone away. Chainalysis reported that DeFi protocols accounted for over $1.1 billion in hacked funds in 2024, approximately 65% of all cryptocurrency stolen during the year. The primary attack vectors — smart contract vulnerabilities, flash loan exploits and oracle manipulation — are well understood, but the sheer number of new protocols launching each month means the attack surface keeps expanding. Insurance protocols like Nexus Mutual, which offers smart contract cover, have seen demand grow 300% year-over-year, suggesting that sophisticated users are hedging their exposure.
Regulation is the other wildcard. The SEC’s 2023-2024 enforcement actions against Coinbase, Binance and Kraken have cast a shadow over centralised exchanges, but DeFi protocols — which often have no identifiable operator to sue — present a novel regulatory challenge. The SEC has indicated it views certain DeFi tokens as securities, and it has brought actions against a handful of DeFi founders. But the core protocols remain largely untouched, in part because there is no company to sue. That will not last forever. The question is whether regulation, when it comes, will be surgical — targeting bad actors while allowing innovation — or blunt, driving DeFi offshore or underground.