Open the Uniswap website, click “Connect wallet”, approve a pop-up in MetaMask and blockchain, where users swap tokens directly from their own wallets without handing custody of their funds to a company.">swap some ether for a stablecoin. The page you used runs on servers paid for by a company, Uniswap Labs. The swap itself ran on code that sits on Ethereum and that no company can edit or switch off. Put those two halves together and you have a dApp, short for decentralised application.
So what is a dApp in crypto? In one sentence: a normal-looking app whose rules live in smart contracts on a public blockchain instead of on a company’s database. The developer documentation of ethereum.org describes it as an application built on a decentralised network that pairs a smart contract with a front-end user interface. You see a website or a phone app; the part that holds and moves money is code on the chain, and your wallet signs every action.
Several of the events below, from the Ronin hack to the Tornado Cash sanctions, already appeared in our timeline of crypto history. Here they serve a narrower purpose: showing which part of a dApp held up and which part failed. Market figures come from DefiLlama on 22 October 2026. Nothing here is investment advice.
What is a dApp: a front end that talks to smart contracts
Every dApp has two halves that are built, hosted and controlled in very different ways.
The back end is a set of smart contracts: programs deployed to a blockchain such as Ethereum, Solana, BNB Chain or Base. Ethereum.org’s documentation places this back end on a decentralised peer-to-peer network rather than on a company server. Once deployed, the contract runs exactly as written, on thousands of computers at once, and anyone can read its code and call its functions. If you need a reminder of how this works on the main dApp chain, our guide to what Ethereum is and how it runs smart contracts covers it.
The front end is everything else you touch: buttons, charts, a search box, the price preview before a swap. Ethereum.org notes that it can be written in any language, just like an ordinary app, and that its job is to make calls to the back end. In practice it is usually a website built with standard web tools, hosted on ordinary servers or a cloud provider, under an ordinary domain name.
Between the two sits your wallet. The website prepares a transaction, the wallet shows it to you, and only your signature sends it to the chain. The company behind the site never holds your coins. That is the real difference with a banking app.
In a bank app, your balance is a line in the bank’s database. The bank can freeze it, reverse a payment or close the account, and a court can order it to. In a dApp, your balance sits at your own address on the blockchain, and the rules for moving it are public code. No help desk can reverse a swap. No company can quietly change the fee in the contract unless the contract was written to allow it.
Take the Uniswap example again, step by step. The website at app.uniswap.org reads prices from the Uniswap pools on the chain and shows you a quote. When you confirm, your wallet signs a transaction addressed to the Uniswap router contract. Validators on Ethereum include it in a block, the contract takes your ether and sends you the other token, and the result is public on a block explorer. Uniswap Labs, the company, wrote the website and much of the code, but its own post of 19 April 2022 draws a line between its app, which it controls, and the protocol, which others can reach through any interface.
The term “decentralized application” (the American spelling most searches use) is older than Ethereum, but the model above, website plus contracts plus wallet, is the one nearly every crypto user meets today.
Decentralised is a spectrum, from the contract to the domain name
A dApp is rarely decentralised from top to bottom. It is easier to judge one by looking at four layers separately.
- The contracts on the chain are the most decentralised part, provided nobody holds a key that can upgrade or pause them. Many projects keep such admin keys, at least at first, or use “upgradeable proxy” contracts whose logic can be swapped.
- The data the contracts depend on may come from outside. Prices, for example, usually arrive through an oracle, which is another service you must trust.
- The front end, its hosting and its domain name are run by a company or a small team. They can be changed, blocked, hacked or shut down like any other website.
- Your wallet is the last layer. It is software on your phone or computer, and it is the only place where a mistake by you turns directly into lost funds.
Ethereum.org lists the same tension among the drawbacks of dApps: centralisation creeps back in when keys are stored on a server or front ends are served from central machines. In most of the failures described below, the contract code at the centre kept working while one of the three outer layers gave way.
DeFi dApps hold the money: $90.8 billion locked as of 22 October 2026
Decentralised finance is the dApp family with the most users and the most money. It covers exchanges where you trade against pools of tokens instead of an order book (decentralised exchanges), lending markets, staking means depositing a proof of stake coin with a protocol that stakes it for you and issues a transferable token (such as Lido stETH or rETH) representing the deposit plus rewards, which you can use or sell while the coins stay staked.">liquid staking and bridges between chains. Our beginner guide to DeFi explains each of these in detail; here the point is scale.
DefiLlama, an open dashboard that tracks DeFi contracts on hundreds of chains, measured $90.8 billion of total value locked across DeFi at 00:00 UTC on 22 October 2026, against $91.6 billion a day earlier. Total value locked means the dollar value of the tokens deposited in those contracts. It is not a profit, a revenue figure or a measure of safety.
| Measure (DefiLlama, 22 October 2026) | Value |
|---|---|
| Total DeFi value locked, all chains | $90.8 billion |
| Value locked on Ethereum | $49.9 billion |
| Value locked on Base | $6.2 billion |
| Value locked on Solana | $6.0 billion |
| Value locked on BNB Chain (BSC) | $5.7 billion |
| Lido (liquid staking) | $23.7 billion |
| Aave V3 (lending) | $17.1 billion |
| Uniswap V3 and V4 (exchange) | $1.7 billion and $1.5 billion |
| Decentralised exchange volume, last 30 days | $265.4 billion, of which Uniswap $69.4 billion |
Two names stand out for a beginner. Uniswap is the largest decentralised exchange by trading volume in that 30-day window. Aave is a lending market spread over about twenty chains, where depositors earn interest and borrowers post crypto as collateral. Both have run for years with the same basic design, which is more than most dApp families can say.
A word on counting. For years, people quoted DappRadar for the number of dApps in use. DappRadar’s founders announced on 17 November 2025 that they were shutting it down, saying that running a platform of that scale had become financially unsustainable, Cointelegraph reported. Its dApp counts stopped updating. DefiLlama lists 8,795 entries in its protocol list today, but that list mixes in centralised exchange wallets, bridges and several versions of the same protocol. There is no reliable current count of dApps, and any figure you see should come with its source and date.
SocialFi: Farcaster and Lens outlived the hype, friend.tech faded
SocialFi dApps try to put social networks on a blockchain: your profile, your followers or your posts are tied to your wallet, so in theory no single company owns your audience. The record so far is mixed, and it teaches something about what “decentralised” protects.
friend.tech, launched on Coinbase’s Base network in August 2023, let users buy “keys” to other people’s chat rooms, with prices rising as more keys sold. The rush did not last. On 8 September 2024 its developers handed control of the contracts to Ethereum’s null address, so nobody can change fees or functions any more; CryptoSlate reported that the app had earned $21 of revenue over the previous 30 days, according to DefiLlama. The contracts still exist. On 22 October 2026 DefiLlama still listed friend.tech V1 in its SocialFi category, with about $2 million still deposited and no team left to develop it.
Farcaster took a different route: a protocol for social accounts that several apps can read, rather than a token for speculation. On 21 January 2026 the developer-tools company Neynar announced it was taking over Farcaster from Merkle Manufactory, the team that built it, and would run the protocol, the main client and the Clanker token tool. “Farcaster is not shutting down,” co-founder Dan Romero said, as quoted by The Block, adding that Merkle planned to return the full $180 million it had raised to investors.
The new owner did not stay long. In August 2026, about seven months after the purchase, Neynar co-founder Rish Mukherji said the company had started looking for a new team to run Farcaster, Clanker and its developer platform, and that Neynar would return most of its remaining balance sheet. The Defiant, citing DefiLlama, put protocol fees at $35.43 million in the first quarter of 2026 and $376,740 in the third quarter up to the announcement.
Lens, a social protocol started by the team behind Aave, also changed hands. On 21 January 2026 Aave passed stewardship of Lens to Mask Network and kept a role as technical adviser, Cointelegraph reported. An Aave spokesperson said the IP, the chain, the website and the Lens account on X moved to Mask; the same report found no sign that treasuries or governance control changed hands. The social graph and the contracts stay open-source.
Farcaster’s two changes of owner in one year make the point. The smart contracts of a social dApp can keep running after the company leaves, but the app people open, the servers that index posts and the money that pays developers depend on a handful of people. A decentralised contract is not the same thing as a decentralised product.
GameFi and play-to-earn: what Axie Infinity taught about token wages
GameFi means games whose items, characters or rewards are tokens you hold in your wallet. Play-to-earn went further: players were paid in tokens for playing, and could sell those tokens for dollars. Axie Infinity, built by the studio Sky Mavis on its own Ronin chain, was the flagship.
Its reward token, Smooth Love Potion (SLP), shows the weakness. According to Decrypt in February 2022, SLP peaked near $0.40 in August 2021 and had fallen to about a penny. Sky Mavis blamed inflation: roughly four times as much SLP was being created each day as was being burned in the game. Daily active users, above 2.7 million at the November 2021 peak, were just under 2.2 million at the end of January 2022, and the studio cut SLP rewards in its next season.
The token was both the wage and the thing every player wanted to sell. A game economy built that way needs a steady flow of new buyers to absorb the selling. When the flow slows, the wage loses value, players leave and selling increases.
Then came the hack. On 23 March 2022 attackers drained the Ronin bridge, which moved assets between Ethereum and Ronin: 173,600 ETH and 25.5 million USDC, found only on 29 March when a user could not withdraw 5,000 ETH, according to the post-mortem summary on Rekt. Withdrawals needed five signatures out of nine validators. Sky Mavis ran four of them, and a fifth, belonging to the Axie DAO, had let Sky Mavis sign on its behalf since November 2021 under a temporary arrangement that was never revoked. The US Treasury later attributed the theft, “worth almost $620 million”, to North Korea’s Lazarus Group.
The smart contracts of the game were not the weak point. The bridge was, and its security rested on a few keys held by one company. The timeline of the previous lesson places the hack among the other events of 2022.
DePIN: Helium, Filecoin and Render pay tokens for real hardware
DePIN stands for decentralised physical infrastructure networks. Instead of a company building radio masts, data centres or render farms, thousands of individuals plug in their own hardware and are paid in tokens. Customers pay to use the network. A dApp handles the accounting on the chain.
Helium does this for wireless coverage, with small hotspots run by individuals; DefiLlama files it under its DePIN category. Filecoin sells decentralised file storage from independent storage providers. Render connects people who need graphics rendered with owners of spare GPUs.
Usage figures for these networks mostly come from the projects themselves or from industry blogs, and they often disagree, so we do not repeat them here. The useful question for a beginner is different: how much of what the suppliers earn comes from paying customers, and how much from new tokens printed to reward them? When most of it is new tokens, the network looks a lot like play-to-earn with hardware attached. Check that split, with a dated source, before taking any DePIN growth claim at face value.
Decentralised identity: from a wallet address to DIDs
The simplest identity in crypto is your wallet address. Many dApps use nothing else: you prove who you are by signing a message with the key behind that address. Sign-In with Ethereum, the ERC-4361 standard, formalises this. The site asks your wallet to sign a short text that includes the site’s domain and a one-time random code. The signature happens off-chain, so it is not a transaction, and the standard tells wallets to check that the request really comes from the domain shown.
Addresses are long and hard to read, so naming services let you attach a readable name to one. The Ethereum Name Service, for example, maps names ending in .eth to addresses.
Decentralised identifiers go further. The W3C, the body that sets web standards, published DID Core 1.0 as a Recommendation on 19 July 2022. Its abstract calls DIDs “a new type of identifier that enables verifiable, decentralized digital identity.” A DID lets you hold credentials, such as a diploma or proof of age, signed by the issuer, and show them without asking the issuer each time. Some DID methods use a blockchain; many do not.
One point to keep straight. The European Union is rolling out European Digital Identity Wallets under Regulation (EU) 2024/1183, known as eIDAS 2: each member state must provide at least one within 24 months of the Commission’s implementing rules. These are government identity apps built on the same family of credential standards. They are not blockchain dApps, and they do not hold crypto.
How to connect a wallet to a dApp safely, step by step
Contract exploits make the biggest headlines, but for an individual user the riskiest moment is usually the wallet pop-up. Scam Sniffer, a security firm that tracks phishing “drainer” sites, counted $83.85 million stolen from 106,106 victims in 2025 in its latest full-year report, published in January 2026. That was 83% less than the $494 million of 2024, but the largest single theft, $6.5 million in September 2025, came from one signature on a “Permit” request. The report covers EVM chains and phishing only, not contract exploits.
Our pictures carry no text, so here are the steps in words. They work for MetaMask, Phantom and most other wallets; menu names change between versions.
- Reach the dApp from an address you trust. Type it or use a bookmark you made yourself, and never follow ads, replies or direct messages. Check the spelling of the domain letter by letter: look-alike sites swap one character or add a word.
- Keep a separate hot wallet with a small balance for dApps. Leave your savings in another wallet, ideally a hardware one, that never connects to new sites.
- Try the dApp first on a test network such as Sepolia, with free test coins. The screens and the signatures are the same, and a mistake costs nothing.
- Click “Connect wallet” and choose your wallet. Connecting only shows the site your public address and balances; it moves nothing. Any site or “support agent” that asks for your seed phrase at this point is a scam, without exception.
- Read every signature request before you approve it. A login message should show the domain you are on. A transaction should show the contract, the amount and the network, and it costs a fee. An approval or a Permit signature gives a contract the right to spend your tokens, sometimes without limit and without a fee to warn you.
- When the wallet offers it, set the approval to the amount you need for this action rather than an unlimited one.
- Turn on the security alerts or transaction preview in your wallet if it has them. They show what will leave your wallet before you sign. They lower the risk; they do not remove it.
- After you finish, review and cancel old approvals with a tool such as revoke.cash or the Etherscan token approval checker. Revoke.cash explains that cancelling an approval is itself an on-chain transaction, so it costs a small fee. Bookmark the real address of these tools too.
- Disconnect the site in your wallet’s list of connected sites. If you think you signed something bad, revoke the approval first, then move what is left to a new wallet.
Approval and Permit requests deserve the most attention. Scam Sniffer found that Permit-type signatures made up 38% of losses in the large cases of 2025, $8.72 million across three thefts. Our guides to protecting your seed phrase and spotting crypto scams go further.
Where dApps break: front ends, domains, hosting and user experience
The contract may be hard to stop. The website in front of it is not, and the history of dApps is full of cases where the weak point was the ordinary web layer.
The company can filter its own front end
On 23 July 2021, Uniswap Labs removed more than 100 tokens, including tokenised stocks and derivatives, from its own interface, citing the changing regulatory picture, according to The Block. The tokens stayed in the protocol; other interfaces could still reach them. In April 2022 the company said its app blocks addresses sanctioned by the US Office of Foreign Assets Control (OFAC) and wallets that the analytics firm TRM Labs links to crimes such as theft and ransomware. Users of the official site live by the company’s rules, even though the contracts have no such filter.
Governments can go further. On 8 August 2022 the US Treasury sanctioned the Tornado Cash mixer, which it said had been used to launder more than $7 billion since 2019. GitHub then removed the project’s code. After Treasury clarified on 13 September 2022 that US persons could copy the open-source code, GitHub restored it in read-only form, according to The Block. The pool contracts kept running throughout. On 26 November 2024 the Fifth Circuit Court of Appeals ruled in Van Loon v. Department of the Treasury that Tornado Cash’s immutable smart contracts are not property, so they cannot be blocked under the sanctions law, and on 21 March 2025 Treasury lifted the sanctions.
The domain can be hijacked
In September 2023 attackers took over the domain of the Balancer exchange and redirected visitors to a copy of the site wired to a malicious contract; PeckShield estimated about $238,000 was taken, as The Block reported. Curve suffered a DNS attack on its curve.fi domain in 2022 and another in May 2025, when the team said the incident was “strictly limited to the DNS layer” and sent users to curve.finance. In each case the smart contracts were untouched. Users who clicked the right address still reached the wrong site, which is why a bookmark helps but is not enough on its own.
One partial answer is to publish the front end on IPFS, a set of open protocols that find files by their content rather than by a server address, so that anyone can host an identical copy. It spreads the hosting; it does not stop a user from opening a fake copy.
User experience is still the hardest part
Using a dApp means paying gas fees in the chain’s own coin, choosing the right network, guarding a seed phrase and accepting that a mistake cannot be undone. Ethereum.org lists user experience, network congestion and maintenance among the drawbacks of dApps. Layer 2 networks lower fees a lot; a later lesson compares them with layer 1 chains.
Wallets are slowly getting easier. The ERC-4337 standard for “smart accounts”, whose EntryPoint contract went live on Ethereum on 1 March 2023, lets a wallet be a contract with its own rules: several signers, custom recovery, fees paid in tokens or by the app. The Pectra upgrade of 7 May 2025 added EIP-7702, which lets an ordinary address borrow such features, including spending limits, according to the Ethereum Foundation. The same feature opened a new trick: Scam Sniffer recorded two large thefts through malicious EIP-7702 batch signatures in August 2025, totalling $2.54 million. Every convenience in a wallet is also a new thing to read before signing.
What regulators say about dApps in the US, the UK and the EU
In the United States, the SEC sent Uniswap Labs a Wells notice in 2024, a warning that it might bring charges. On 25 February 2025, Uniswap Labs wrote that “The SEC has officially closed – with no action – its multi-year investigation into Uniswap Labs.” That ended one investigation; it is not a ruling that every DeFi front end is legal, and US sanctions still apply to the people who use and run them, as the Tornado Cash case showed.
Taxes do not disappear either. The IRS treats virtual currency as property, and its FAQ says exchanging it for another virtual currency produces a capital gain or loss. A swap on a dApp is a taxable event in the US even though no company sends you a form. In the UK, since 8 October 2023, firms promoting crypto to UK consumers must be authorised or registered by the FCA, have their ads approved by an authorised firm or fit an exemption, wherever they are based.
The European Union wrote decentralisation into its crypto law. Recital 22 of the MiCA regulation says MiCA applies even when part of a service is decentralised, but that “where crypto-asset services are provided in a fully decentralised manner without any intermediary,” they fall outside its scope. The text does not define “fully decentralised”, and most dApps have a company somewhere in the stack. Our guide to MiCA and what it changes for users covers the rest.
Read the other side of that recital too. A truly decentralised dApp has no licensed firm behind it, so there is no complaints desk, no deposit guarantee and no regulator to call if something goes wrong. The EU’s three financial supervisors made the same point in a joint consumer warning of 6 October 2025: legal protection, if there is any, may be limited depending on the crypto-asset.
Five checks before you use any dApp
- Find out who runs the front end, and whether the contracts can be upgraded or paused by an admin key.
- Look the protocol up on DefiLlama or a block explorer and note how long it has been running.
- Use a separate hot wallet with a small balance, and test with a small amount first.
- Read every signature, and refuse unlimited approvals you do not need.
- Revoke old approvals and disconnect the site when you are done.
Most of the money that moves through dApps is in stablecoins, tokens that track the dollar. The next lesson of this path compares the two largest, in USDT vs USDC: how Tether and Circle differ.
