On 3 August 2026, the DeFi portfolio tracker Zapper was due to switch off for good. Its website, mobile app and API services were set to close after close to seven years, ending a dashboard that its chief executive, Seb Audet, said had reached 2 million monthly active users. He gave no official reason, writing that “an orderly wind down is the best course of action” and adding in a reply that “the market decides”. A closure like that moves nobody’s lending position, because the positions sit in contracts on public chains. What goes is the window onto them, along with whatever history a user had come to rely on it for.
Nine months earlier the opposite failure had played out. The window was fine and the picture was wrong. Stream Finance, an on-chain fund issuing a token called xUSD, disclosed a loss of about 93 million dollars in early November 2025, and people who thought they held several separate vaults found they shared one borrower. A DeFi portfolio tracker could have shown them tidy, diversified lines until the day it did not.
Both failures call for the same three habits. Sort your positions by what can break. See them with a tool that reads a public address and never asks for a secret. Then keep your own record, because the tool may close and tax offices ask for history that a dashboard does not hold.
It follows the lesson on delta-neutral strategies and assumes you know the building blocks. Two reminders before starting. A headline yield says nothing about where it comes from, and the difference between real and subsidised yield decides how long it lasts. A protocol’s size is no proof of safety either: TVL has its own measurement traps, and a large blockchain that runs exactly as written when it is called, holding and moving funds according to its code, without an intermediary able to change the outcome.">smart contract holding reserves of two or more tokens, supplied by users, that a decentralized exchange uses to execute trades automatically at a price set by a formula.">pool can still sit on one fragile dependency.
Nothing here is a recommended allocation. The tiers describe risk, the percentages you pick are yours, and no percentage is offered.
Allocation by risk tier: sort by what can break
Why the label on a position beats its yield
Most people list a portfolio by token: some ETH, some USDC, something earning 5 percent. That list hides the useful information. Two lines of USDC can be a balance in your own wallet and a deposit in a curated vault, and they fail in completely different ways.
A DeFi position is closer to a promise made by a contract. This pool will return my deposit. This token will trade near one dollar. This vault manager will lend only against good collateral. Every promise adds a party or a piece of code that has to keep working, so the question for each position is who can lose your money, and how.
Five tiers answer that well enough for a personal portfolio. They count layers of dependency. They do not measure price risk: ETH in tier 1 can still fall 30 percent in a week, and a dollar stablecoin in tier 3 can look perfectly flat until it stops. You need both views.
The five tiers and what each one has broken
| Tier | What you hold | What breaks | A dated real case | What to check |
|---|---|---|---|---|
| 1. Self-custodied assets | ETH, BTC or stablecoins in your own wallet | Your keys, a malicious signature, the stablecoin issuer | No single case: losses here come one wallet at a time, from a stolen seed or a signed malicious approval | Where the seed is stored, what you have signed, who issues the stablecoin |
| 2. Liquid staking | stETH, wstETH and similar | A discount to ETH when sellers need out, slashing, contract risk | June 2022: stETH near 0.94 ETH, a discount of about 6 percent (CoinShares) | Exit queue, market depth, how the token handles rewards |
| 3. Lending and vaults | Aave deposits, curated vaults, yield-bearing dollars | Bad debt, a weak collateral, a strategy manager, withdrawal limits | November 2025: Stream xUSD left about 15 million dollars of bad debt on Silo | Collateral list, curator, utilisation, redemption terms |
| 4. Liquidity provision | Uniswap or Curve LP positions | Impermanent loss, a depegging pair asset, a position out of range | Same pair, two pools, 13.74 and 2.06 percent APY on 1 November 2026 | Fee income against loss, range, pool share |
| 5. Leveraged or farmed | Borrowed loops, points farms, new incentive pools | Liquidation, reward token collapse, stacked failures of every tier below | 10-11 October 2025: over 19 billion dollars of leveraged positions liquidated in 24 hours (CoinGlass) | Health factor, liquidation price, what happens when the rewards stop |
Tier 2 is the place to learn the difference between a backing problem and a liquidity problem. In June 2022, CoinShares recorded stETH at 0.94 ETH in a note dated 16 June 2022, while the underlying ether stayed locked with no withdrawal date and lenders such as Celsius might have to sell to meet redemptions. Withdrawals exist now, but the principle stays: a liquid staking token depends on an exit route, and the route narrows when everyone uses it together. On 1 November 2026, DefiLlama showed about 22 billion dollars in stETH from Lido on Ethereum.
Tier 4 positions deserve a separate warning about yield displays. The USDC-WETH pair on Uniswap v3 at Ethereum showed 13.74 percent in the 0.05 percent fee pool and 2.06 percent in the 0.3 percent pool on the same morning, per DefiLlama. Those are fee figures, with impermanent loss not counted. A number that varies more than sixfold across pools holding the same pair tells you to measure your own result.
Tier 5 is the only tier where you can lose everything through arithmetic alone. Borrowing means one number, your health factor and liquidation price, has to stay on the right side of a line through every price move. Across the deployments of Aave, Chaos Labs counted about 180 million dollars of on-chain liquidations in its report on the sell-off of 10 October 2025, a fall that for numerous assets took about ten minutes. Across the whole market, CoinGlass data cited by CoinGecko put forced closures at over 19 billion dollars of leveraged positions on 10-11 October. That total measures the size of the positions closed, which is a different thing from the money lost.
Hidden concentration: three vaults, one borrower
The tier table sorts positions one at a time, and that leaves the worst risk out. Stream Finance shows how. According to an impact assessment posted on the Arbitrum DAO forum on 7 November 2025, Stream ran as an on-chain tokenised hedge fund with over 200 million dollars of deposits, and a substantial part of that capital was deployed recursively: xUSD deposited into lending markets, stablecoins borrowed against it.
When redemptions began, the post says, “select lending markets were left with borrowed amounts exceeding the value of the underlying XUSD collateral”. Its count at that date: about 15 million dollars of bad xUSD debt on Silo, about 700,000 on Morpho through an MEV Capital vault, very high utilisation but no bad debt on Euler, and no direct impact seen on Aave, Dolomite or Fluid. xUSD itself fell about 77 percent in a day, Decrypt reported.
The wider web of links was the surprise. The research group Yields and More estimated at least 284.9 million dollars of debt tied to Stream across lenders and curators, a figure it warned was neither complete nor guaranteed accurate. Stream attributed its loss to an external fund manager rather than to a contract bug, though some outlets called it a hack, and the final losses remain unclear. A reader holding three vaults under three brand names could still have been exposed to this one balance sheet.
The same check applies to stablecoins, chains and price feeds. During the sell-off of 10 October 2025, USDe briefly fell to 65 cents on Binance, CoinDesk reported, against about 92 cents on Bybit and a deviation under 1 percent on Curve. CoinGecko’s account of the crash gives the same Binance low. CoinDesk says Binance priced USDe from its own relatively thin order book, and Ethena’s founder, Guy Young, called the gap “isolated to a single venue”, saying redemptions took supply from about 9 billion to 6 billion dollars without any basis position being unwound. Accounts differ on whether that counts as a depeg or a pricing dislocation. The practical result is clearer: anyone whose collateral was marked on that one order book had a different day from anyone marked elsewhere, and no balance line on any dashboard told them which they were.
So add one column to your tier list: what each position finally rests on. Go down until you reach a name. Which stablecoin, which curator, which chain, which oracle. If one name appears on most lines, you hold a single bet in several wrappers.
A worked example with fictional amounts
This is an exercise to show the method, not a model portfolio. The amounts are invented and the rates are DefiLlama pool figures read on 1 November 2026, which will have changed by the time you read this.
| Line (example only) | Tier | Amount | APY, 1 Nov 2026 | Paper yield per year | Rests on |
|---|---|---|---|---|---|
| Aave V3 USDC supply, Ethereum | 3 | $4,000 | 3.91% | $156.4 | Aave, USDC, Ethereum |
| Lido stETH | 2 | $3,000 | 3.23% | $96.9 | Lido, ETH, Ethereum |
| Ethena sUSDe | 3 | $2,000 | 5.06% | $101.2 | Ethena hedges, Ethereum |
| Uniswap v3 USDC-WETH, 0.3% pool | 4 | $1,000 | 2.06% | $20.6 | Uniswap, USDC, ETH, Ethereum |
| Total | $10,000 | 3.75% | $375.1 |
On a tracker this looks calm: four lines, four protocols, a blended 3.75 percent before gas, tax and impermanent loss. Read the last column and the picture changes. All four sit on Ethereum mainnet. USDC appears twice. About 35 percent of the money is direct ETH exposure, through the stETH line and the ETH half of the LP.
Now run a bad week, again with made-up shocks. ETH falls 20 percent and stETH trades at a 6 percent discount to ETH. The stETH line drops from $3,000 to about $2,256. A full-range LP position would fall from $1,000 to about $895, and a tighter range would lose more. Aave and sUSDe hold their dollar value in this scenario, but DefiLlama lists sUSDe with a seven-day unstaking period, so that $2,000 is not cash on the day you want it. The total reads about $9,151, a fall of about $849. That is more than two years of the paper yield, gone in one exercise.
That comparison is what the drill is for. It shows which line would hurt and which would be stuck, while you still have time to decide whether you can live with both.
Which DeFi portfolio tracker in 2026: what reads your address, and which one wound down
How a tracker works, and the one rule that protects you
A tracker reads public chain data for an address, recognises which tokens and contracts sit behind it, and values them. It needs the address and nothing else. Your wallet’s secret keys play no part, since reading a public ledger requires no permission.
That gives you a rule with no exceptions. A tracker never needs your seed phrase or private key. It does not need a signature to display a balance either. If a site asks for the first, stop and leave. If it asks you to sign a transaction or approve a token in order to “connect” or “sync”, treat it as a possible drainer until proven otherwise. Pasting an address into a search box is enough for every read-only tool below.
DeBank, Zerion, rotki and the gap Zapper left
| Tool | Status, 1 Nov 2026 | How it reads you | Coverage (as claimed or reported) | Cost |
|---|---|---|---|---|
| DeBank | Live, per third-party coverage to October 2026 | Paste a public address, or connect a wallet (Plisio) | Dozens of chains, counts differ by source; Solana coverage reported inconsistently | Free basics; paid extras such as Time Machine and deeper history analysis (Plisio, May 2026) |
| Zerion | Live, also a self-custodial wallet | Watch any address, no signup | 66 chains and 4,500+ protocols per Zerion, Solana included | Free tracking per Zerion; Premium $99 a year for one wallet, no automatic renewal |
| rotki | Live, open source (AGPL-3.0) | Local app on your device; addresses, plus read-only API keys for exchanges | 190+ exchanges, blockchains and protocols per rotki | Free up to 1,000 events; paid plans 9, 25 and 45 euros a month billed monthly |
| Zapper | Closure announced for 3 August 2026 | Do not plan on it | Not applicable | Not applicable |
DeBank is the hardest of the three to pin down, so treat what follows as reported, not confirmed. A May 2026 review by Plisio describes more than a thousand protocols across dozens of chains, and says you can connect a wallet or paste any public address. It lists Time Machine, deeper transaction history, larger follow lists and NFT and profit-and-loss accounting among the paid features, and places the Rabby wallet and the Hi! messaging product in the same family. The chain count moves from page to page: Zerion, a direct competitor, puts it at about 95 in a comparison updated on 6 October 2026, and others give lower numbers. Published sources disagree on Solana too, so if you hold positions there, paste one of your own addresses and see what appears.
Zerion’s tracker offers watch-only tracking of any address with no signup, and says it finds LPs, staked assets, lending positions, debts and rewards on its own. Zerion is also a self-custodial wallet, but you can use the tracker without importing a single key into it. Its Premium plan costs 99 dollars a year for one wallet, with no automatic renewal, halves Zerion’s swap and bridge fees on supported networks, and adds realised and unrealised profit and loss for any wallet address.
rotki works the other way around. It is an application on your own machine, with your history kept in an encrypted database on your device, exchanges connected through read-only API keys, and profit-and-loss reports exportable as CSV. The site is direct about the limit, calling itself “not a tax filing service” and telling users to check results against local rules. Its free plan stops at 1,000 historical events, then 3,000, 30,000 and 100,000 events on the paid plans as of 1 November 2026, a limit an active DeFi address can reach quickly. Check prices before paying. The project’s GitHub repository shows the AGPL-3.0 licence and release v1.44.2, dated 22 October 2026.
DefiLlama belongs in your bookmarks, for a different job. It is the reference for protocol data such as TVL, fees and yields, and on 1 November 2026 its navigation offered watchlists of protocols rather than a portfolio view by address. Be careful with lookalikes: pages that look like unofficial “DefiLlama wallet” sites show up in search. LlamaFolio, an older open-source tracker, is a warning of its own: its API repository has had no push since May 2024, and its old domain no longer hosts the project. Type addresses yourself and keep bookmarks.
What trackers get wrong
A dashboard is an interpretation of chain data, and some interpretations fail in predictable ways.
- Rebasing tokens change balance without a transfer, so history views can show income that never appears as a transaction, or miss it.
- New chains and small protocols may be missing, and a position the tool does not recognise can look like an empty wallet or a worthless token.
- LP positions are valued from the pool’s current state, which says little about what you would have earned by simply holding the two assets.
- Totals labelled net worth can treat borrowed funds in different ways, so check whether debt is subtracted before trusting the number.
- Locked and unbonding positions usually show at full value, even when you cannot sell them for a week or more.
- A displayed price is only one source. It tells you nothing about the oracle your lending market uses, and that oracle decides your liquidation.
Check any tracker against the protocol’s own interface at least for your largest positions. If the two differ, the protocol’s contract is the truth.
Three questions before choosing a DeFi portfolio tracker
There is no best tool in the abstract, and any ranking would date quickly. Ask where your positions live, since a tool that misses a chain is useless to you whatever its reputation. Ask how much you mind a company knowing which addresses you follow: a local app such as rotki answers that differently from a hosted service. Ask whether you need history and exports, or only a live view. One workable setup pairs a hosted dashboard for the daily glance with a local record for the file, which also limits the damage when a service disappears.
The privacy cost of a public address
Every tracker relies on the same fact: an address is readable by anyone. That includes the balance, the protocols, the size of each position and the time you act. Plisio reports that DeBank’s paid features include larger follow lists for tracking other wallets, and that its feed shows activity for any address a user follows, so looking through somebody else’s portfolio is routine on these tools.
On its own, an address is a string of characters. The exposure comes when it is tied to you. An ENS name that matches your social handle does it, as does a screenshot posted with the address visible, a withdrawal from a KYC exchange to the same wallet you discuss in public, or a data breach at any service that holds both your name and your address.
The physical risk is real, even if trackers do not cause it. CertiK counted 72 verified wrench attacks in 2025, physical assaults on crypto holders, up 75 percent on the year before, with 40.9 million dollars of confirmed losses and 19 incidents in France alone. CertiK warned that the loss figure could be understated. The Block reported about 60 cases from TRM Labs and about 70 from Jameson Lopp’s log for the same year, so read these as orders of magnitude.
A few habits limit the exposure, and they fit the tier system. Use separate addresses for separate tiers, so that one farm position does not reveal your long-term holdings. Do not reuse a public, named address for anything large. Share portfolio screenshots only after removing the address and the total. If you publish or send your log to anyone, replace addresses with labels. And remember what a watchlist on a hosted service means: that service now has a list of addresses grouped by one user.
The position log: your own record of every move
Why keep a log when a tracker exists
Zapper is the first reason. Trackers close, change their pricing or drop support for a chain. Protocols migrate to new versions and front ends disappear, while the transaction remains on chain with no plain-language story attached. Your own file keeps that story.
Yield you cannot explain is the second reason. A log tells you what you put in, what you took out and what it cost in gas, and that is the only honest way to learn whether a 5 percent position paid 5 percent. The third is an incident: when a protocol announces a problem, a log shows in seconds which wallet, chain and contract are affected. The fourth is tax, covered below.
The columns of a useful log
A spreadsheet is enough. Make one row per action, not one row per position, so that a position with five reward claims has seven rows.
| Column | What to write | Why it matters |
|---|---|---|
| Date and time (UTC) | Block time from the explorer | Valuation and order of events; one time zone avoids errors |
| Action | Deposit, borrow, repay, claim, swap, add or remove liquidity, stake, unstake, withdraw | Each action may have a different tax and risk meaning |
| Protocol and version | Aave V3, Uniswap v3 | Versions have separate contracts and risks |
| Chain | Ethereum, Arbitrum, Base | The same token address may mean something else elsewhere |
| Wallet label | “Long-term”, “Farm 1” | A label, so the file can be shared without the address |
| Contract or token address | Copied from the explorer | Identifies the exact position; symbols can be faked |
| Deposit (amount in) | Token and quantity | Basis of every later calculation |
| Entry price and source | Fiat value at that moment, and where it came from | Cost basis and income value need a dollar or pound figure |
| Gas | Paid in token and in fiat | A real cost, large on small positions |
| Rewards claimed | Token, date, fiat value at claim | May be income when received, depending on your country |
| Exit | Date, amount out, fiat value | Closes the position and measures the result |
| Transaction hash | Full hash | Proof, and the link back to the chain |
| Tier and reason | 1 to 5, one line on why you entered | Keeps your original reasoning honest at review time |
For borrowing positions add two more cells: the health factor and the liquidation price at entry. For anything else, add the dependency you found earlier, so a search for one stablecoin or curator returns every row exposed to it.
Logging yield that arrives with no transaction
Rebasing tokens are the hard case, and the place where most homemade logs go wrong. Lido’s integration guide says stETH balances normally update daily when the oracle reports, can in principle fall after penalties, and change with no ERC-20 Transfer event, which is why it warns against storing cached balances for over 24 hours. Summing transfers will therefore understate what you hold. Lido tracks ownership in shares, so log the shares at entry and exit. The wrapped form behaves differently: in Lido’s words, “wstETH balance does not rebase, wstETH’s price denominated in stETH changes instead.”
Aave has a similar logic. Its documentation says aToken balances increase over time from borrowing activity in the pool. A contributor on Aave’s governance forum explains that the balance is the scaled balance multiplied by an index, so reconstructing a past balance needs the index at that moment. For your log, the workable habit is to record the quantity at entry, the quantity at exit and each intermediate date you value the position. The growth between those dates is your measured yield.
A filled example with fictional data
| Date (UTC) | Action | Protocol, chain | Wallet | Amount | Value | Gas | Hash | Tier |
|---|---|---|---|---|---|---|---|---|
| 2026-03-02 09:14 | Deposit | Aave V3, Ethereum | Long-term | 4,000 USDC | $4,000 | $1.10 | 0xexample1 | 3, lending yield |
| 2026-03-02 09:31 | Stake | Lido, Ethereum | Long-term | 1.5 ETH, shares noted | $3,000 | $0.95 | 0xexample2 | 2, staking |
| 2026-06-30 18:02 | Valuation, no transaction | Aave V3, Ethereum | Long-term | 4,051 aUSDC | $4,051 | none | none | 3, growth noted |
| 2026-09-14 07:40 | Withdraw | Aave V3, Ethereum | Long-term | 4,102 USDC | $4,102 | $0.80 | 0xexample3 | 3, exit, reason: review |
All of those rows are invented, and the prices and gas are placeholders. Store the real file offline or in encrypted storage, because it links your addresses together in one place. Export it to a plain format such as CSV once a year, so that no single app holds your record.
A review rhythm that fits around a normal week
The log earns its keep only if you open it. A schedule works better than constant watching, and the frequency should follow the tier.
- Every week, spend five minutes on the tracker: check any health factor, any stablecoin or staking token off its usual price, and any unclaimed position you forgot.
- Every month, compare your tier split with what you wrote down at the start, and note why it moved. Price alone can push a portfolio into a riskier mix.
- Every quarter, redo the dependency column: has a vault changed its collateral list, has a protocol moved chains, has a reward programme ended?
- Every time a DeFi incident reaches the news, search your log for the protocol, token, curator and bridge named, the same day.
- Every year, export the log, reconcile it with the chain and prepare your tax file.
Leverage changes the schedule. On 10 October 2025 a fall of about ten minutes was enough for many assets, so a weekly check suits a borrowed position badly. Alerts help, but they depend on someone else’s service staying up at the worst moment. The safer defence is a wider margin at entry.
Keep one more line in the file: what would make you exit each position. Written in calm conditions, it is more useful than anything you decide during a depeg.
The tax return is where the log pays for itself
This section is information, not tax advice, and rules vary by country. The point is practical: a tax office asks for records that no dashboard guarantees to keep for you.
In the United States, the IRS digital assets page, reviewed on 2 September 2026, tells taxpayers to keep records of each purchase, receipt, sale, exchange or other disposition, and of the fair market value in dollars of assets received as income or payment. Sales and exchanges go on Form 8949, while income from staking and similar items goes on Schedule 1. It adds: “Generally, the basis of a digital asset is the cost in U.S. dollars.” Brokers report on Form 1099-DA for transactions from 1 January 2025, but the same page says the final regulations do not include reporting requirements for decentralized or non-custodial brokers. In practice, your self-custodied DeFi activity is unlikely to arrive on a neat form, and your log is the record. Our guide to crypto taxes in the United States covers the wider picture.
In the United Kingdom, HMRC treats a disposal as a broad concept that includes exchanging one token for another, while moving tokens between addresses you control is not a disposal. Tokens normally go into a section 104 pool, with same-day and 30-day rules on top, so dates and pound values matter. On DeFi lending, HMRC says it depends on whether beneficial ownership really passes, which requires reading the contract or terms. Save a copy of the protocol’s terms next to the log entry for that reason. See crypto taxes in the UK for more.
Whatever your country, a log with date, quantity, fiat value and hash gives an accountant or a tax tool something to work from. How to turn it into a figure is explained in how to calculate crypto capital gains, and our crypto tax basics set out the general logic. The treatment of many DeFi operations remains unsettled in several countries, which is a further reason to record the facts now and classify them with a professional later.
The next step in this course moves from your own file to the risks themselves: a full map of what can go wrong in DeFi, with one real case for each kind of failure.
