DeFi Lending Promises High Yield. Here's Where That Yield Actually Comes From, and What Can Go Wrong
6 min read
Loading...
6 min read
An app is offering you 5%, maybe 8%, a year just for depositing crypto you already own. No lockup, a number that updates constantly, and it looks a lot like a savings account. DeFi lending yield works nothing like a savings account, and the difference is exactly where the risk hides.
Aave and Compound, the two largest DeFi lending protocols, currently pay something like 3.8% to 5.2% on USDC deposits on Aave's Ethereum market, and roughly 3% to 5% on Compound's, both figures from rate roundups retrieved 2026-08-18. That is higher than what most Indonesian bank deposits pay, but nobody at Aave or Compound is a bank, and nothing backs your deposit the way a bank deposit is backed. Here is what actually generates that yield, and two real, dated events that show what happens when it breaks.
A DeFi lending protocol is not a bank taking your money and lending it out at its own discretion. It is closer to a shared pool: you deposit USDC or ETH into a smart contract, and other users borrow from that same pool, posting their own crypto as collateral worth more than what they borrow. The interest those borrowers pay flows, minus a small protocol fee, straight to whoever supplied the pool. That is the yield.
Most borrowers on Aave or Compound are not spending the money. They are borrowing against a crypto position they do not want to sell, often to open a leveraged trade or to free up cash without triggering a taxable sale. Demand for that kind of borrowing, not a central bank policy decision, is what sets the rate.
Both protocols set rates with an automated formula built around utilization, the share of the pool that is currently borrowed out. When utilization is low, plenty of the pool sits idle, so the rate borrowers pay, and therefore the rate lenders earn, stays low. As utilization climbs, the rate rises with it, gently at first and then sharply once utilization crosses a threshold usually set around 80%, a design known as a "kinked" rate curve.
That kink exists to protect the pool. If almost everyone's deposit is lent out, a lender who wants to withdraw could find there is not enough uncommitted cash left in the pool to pay them, so the steep rate increase above the kink is meant to pull in new deposits, or push out some borrowers, before that happens.
On 18 April 2026, an attacker forged a cross-chain transfer message on the bridge used by Kelp DAO, a liquid restaking protocol, tricking it into releasing 116,500 rsETH, about 18% of the token's entire circulating supply, without any real collateral ever having moved (CoinDesk). That rsETH, worth roughly $292 million, was real enough to the protocols that accepted it as collateral.
The attacker deposited about 89,567 of those tokens into Aave and borrowed close to $190 million in ETH and related assets against it, with further borrowing across Compound and Euler pushing the total to around $236 million (CoinDesk). None of this was a failure in Aave's own lending code. The flaw sat one layer up, in the bridge that told Aave the collateral was genuine, and Aave had no way to know otherwise. Aave's own post-incident report put its potential losses as high as $230 million, and the protocol's total value locked fell from $26.4 billion to near $20 billion within days of the exploit (CoinDesk; CoinDesk).
The lesson is not that Aave is uniquely unsafe. It is that a lending protocol's safety depends on every system that feeds it collateral, including bridges you have likely never heard of and did not choose to trust yourself.
Every DeFi loan is over-collateralized: a borrower must post crypto worth more than what they borrow, and if that collateral's value falls too close to the loan's value, the protocol automatically sells it to repay the loan. That single mechanism is usually what keeps lenders whole. In a fast, broad crash, it can also cascade.
In June 2022, the hedge fund Three Arrows Capital and the lender Celsius both unwound large positions built on Aave at the same time, as the TerraUSD collapse and a falling market pushed staked-ETH derivatives away from their expected value. Three Arrows faced more than $400 million in liquidations against roughly $2 billion of debt, and Celsius, mid-freeze, pulled about $247 million in wrapped Bitcoin and $74.5 million in ether off Aave in one stretch as it scrambled to avoid its own positions being liquidated (CoinDesk; FXStreet).
A rupiah deposit at an Indonesian commercial bank is guaranteed by Lembaga Penjamin Simpanan (LPS) up to Rp2 billion per depositor per bank, at an insured rate LPS currently sets at 3.50% for the period running 1 June to 30 September 2026 (LPS). Deposit above that guaranteed rate, and the excess is not covered at all.
| DeFi lending (Aave/Compound) | Indonesian bank deposit | |
|---|---|---|
| Typical yield (2026) | Roughly 3% to 5% on USDC | Up to 3.50% guaranteed rate |
| Backed by | Over-collateralized crypto loans | LPS guarantee, up to Rp2 billion |
| Rate stability | Moves constantly with utilization | Fixed for the deposit term |
| What can fail | Smart contract, bridge, or collateral-price risk | Bank default beyond the guaranteed amount |
Neither side of that table is automatically the better choice. The point is that DeFi lending's extra percentage point or two is not a better savings account. It is compensation for risks a guaranteed bank deposit does not carry at all.
Before depositing into any DeFi lending pool, look at what you would actually be holding exposure to. NetWort's Explore screener lets you filter assets by type and compare volatility and maximum drawdown side by side, a faster way to see how a protocol token like AAVE itself has actually moved than reading its marketing page. If you already hold a stablecoin and are weighing whether to put it to work for yield, the stablecoin yield risk breakdown covers the deposit side of this same trade-off in more depth.