You open a wallet app, type 1,000 into the box, pick USDC on one side and ETH on the other, and press blockchain, where users swap tokens directly from their own wallets without handing custody of their funds to a company.">swap. Ten seconds later the ether is there. That tap looks like one action. Underneath it, at least five separate systems did their part, each built by a different team, each with its own risks. Put them on top of each other and you get what people call the DeFi stack.
Here is what happened below the screen. The wallet asked an aggregator to find the best price across dozens of pools. The aggregator sent the order to one or more decentralised exchanges, where a smart contract holding reserves of two or more tokens, supplied by users, that a decentralized exchange uses to execute trades automatically at a price set by a formula.">pool of tokens filled it. The dollar token you sold, USDC, exists because a company issues it and holds the reserves. Lending markets that use the same ETH price rely on an oracle, a service that brings market prices onto the chain. And the whole thing was ordered, made final and paid for in gas on a settlement blockchain.
This lesson walks that stack from the bottom up: what each layer does, who leads it as of 27 October 2026 with figures from DefiLlama, and why plugging the layers together makes DeFi both useful and fragile. The five layers are one way to draw the map, our editorial model, not an industry standard. It is a map you can reuse to place any protocol you meet.
Why the DeFi stack is a pile of layers, not one product
If you are new here, start with our plain explanation of what DeFi is. The short version: financial services such as exchanging, lending and borrowing run as smart contracts on a public blockchain, and anyone with a wallet can use them without opening an account. Ethereum’s own introduction to DeFi puts the shared base simply: “DeFi products all speak the same language behind the scenes: Ethereum” (ethereum.org).
That shared language is the reason a stack forms. A lending protocol does not need to build its own dollar, its own price feed or its own exchange. It takes them from the layers below and becomes, in turn, a building block for the layers above. How this grew from MakerDAO’s Dai in 2017 to the market of 2026 is the subject of our history of DeFi; here we look at the structure as it stands today.
One word on numbers before the map. To show the size of each layer we use staking or liquidity, measured at current market prices. It is the main size metric in DeFi.">total value locked (TVL), the dollar value of the assets deposited in a protocol’s contracts, plus trading volumes and fees. TVL is a rough gauge with known blind spots: it moves with token prices, and the same dollar can be counted in two protocols. A later lesson of this course covers how to measure DeFi and where TVL misleads. For now, read the figures as orders of magnitude.
As of 27 October 2026 (00:00 UTC), DefiLlama put total DeFi TVL across all chains at about $87.8 billion. The all-time high in the same series was $177.5 billion on 9 November 2021. In dollar terms, DeFi holds roughly half of what it held at the peak of the last bubble.
The map of the stack: five layers from settlement to screen
The table below is our diagram of the DeFi stack. Read it from the bottom row up: each layer uses the ones under it. The leaders named are the largest by DefiLlama’s figures on 27 October 2026; the risk column says what typically breaks at that level.
| Layer (read bottom to top) | What it does | Leaders, 27 October 2026 (DefiLlama) | Main risk |
|---|---|---|---|
| 5. Aggregators and interfaces | Finds the best route for a trade and gives the user a screen to sign | Jupiter, DFlow, 0x, KyberSwap, 1inch ($64.6 billion of aggregator volume in 30 days); wallets MetaMask, Phantom, Trust Wallet | Hijacked website, phishing, harmful approvals |
| 4. Derivatives | Leverage, hedging, perpetual futures, synthetic dollars | Hyperliquid ($8.31 billion across its products), Jupiter Perps ($0.71 billion), GMX, dYdX; Ethena’s USDe | Liquidation cascades, thin markets, wrong mark price |
| 3. Primitives | Lending and borrowing; swapping tokens; staking tokens | Aave ($17.45 billion), Morpho ($11.37 billion), Spark ($9.22 billion); Uniswap ($64.4 billion of volume in 30 days), PancakeSwap, Curve; Lido ($22.35 billion) | Contract bugs, bad collateral, mass liquidations |
| 2. Money and data | Dollar tokens; price feeds from outside the chain | USDT ($181.84 billion), USDC ($71.19 billion), USDS; oracles Chainlink, Pyth, RedStone | Loss of peg, issuer freeze or failure, wrong or stale price |
| 1. Settlement | Orders transactions, runs contracts, makes results final, charges gas | Ethereum ($48.18 billion of $87.98 billion), Base, Solana, BNB Chain, Tron; bridges such as LayerZero | Chain halt, congestion and high fees, bridge exploit |
Two things do not fit neatly in one row. Bridges, the contracts that move tokens between chains, sit inside the settlement layer as the pipes between base chains. proof of stake coin with a protocol that stakes it for you and issues a transferable token (such as Lido stETH or rETH) representing the deposit plus rewards, which you can use or sell while the coins stay staked.">Liquid staking and restaking (Lido, ether.fi, EigenLayer) start at the settlement layer, because they stake the chain’s own coin, and produce tokens that are then used as collateral in the primitives. We place them between layers 1 and 3 and treat them with the primitives below.
Layer 1: the settlement chain and its rollups
Settlement is the job of the base blockchain. It puts transactions in order, executes the smart contracts, and makes the result final so that nobody can undo it later. Every action higher in the stack ends here, and every action pays a fee in the chain’s coin, the gas. When the base chain stalls or its fees jump, every protocol built on it stalls or gets dearer at the same moment.
There is no single settlement chain. DefiLlama tracked 421 chains on 27 October 2026, but the money is concentrated on a few of them.
| Chain | DeFi TVL, 27 October 2026 (DefiLlama) | Type |
|---|---|---|
| Ethereum | $48.18 billion | Base layer |
| Base | $6.00 billion | Rollup on Ethereum |
| Solana | $5.71 billion | Base layer |
| BNB Chain | $5.49 billion | Base layer |
| Tron | $5.40 billion | Base layer |
| Bitcoin | $4.26 billion | Base layer |
| Hyperliquid L1 | $2.38 billion | Base layer |
| Arbitrum | $1.50 billion | Rollup on Ethereum |
| All chains | $87.98 billion | Sum of 421 chains |
Ethereum alone held $48.18 billion, about 55 percent of the $87.98 billion sum of all chains (our calculation from DefiLlama’s chain figures). More than half of DeFi still settles on one chain.
Ethereum and the layer-2s that settle on it
Several of the chains in the table are not independent. Base and Arbitrum are rollups, layer-2 networks that execute transactions off Ethereum’s main chain and post the results back to it, so their users get lower fees while final settlement stays on Ethereum. Our guide to layer 1 versus layer 2 explains how that works. Counted together, Ethereum and the rollups that settle on it hold well over half of all DeFi deposits. A DeFi user on Base is, two levels down, still relying on Ethereum.
Solana, BNB Chain, Tron, Hyperliquid and Bitcoin
The other base layers each carry a different slice of activity. Solana ($5.71 billion) hosts a busy market for fast, cheap trading and many new tokens. BNB Chain ($5.49 billion) is tied to the Binance ecosystem. Tron ($5.40 billion) is mostly a payment rail for the USDT stablecoin, with lending on JustLend on top. Hyperliquid’s own chain ($2.38 billion) was built around one application, a derivatives exchange we meet again in layer 4. Bitcoin ($4.26 billion) has little native DeFi, but its coin is increasingly used as collateral, for example through restaking on Babylon.
Between these islands run the bridges. DefiLlama lists LayerZero V2 at $16.37 billion and wrapped bitcoin (WBTC) at $9.28 billion on 27 October 2026. Those sums overlap with deposits counted elsewhere, so they should not be added to the totals above, but they show how much value sits in the pipes. Bridges have also been the most attacked part of the base layer, a point we return to under risk.
Layer 2: money and data, stablecoins and oracles
On top of the settlement chain sit two kinds of infrastructure that almost every protocol needs: a stable unit of account, and reliable information about prices. Neither is a DeFi application in the usual sense. Both are the ground the applications stand on.
Stablecoins: the dollar of DeFi
A trader on a DEX quotes ETH in dollars. A lending market lends dollars. A derivatives exchange settles profit and loss in dollars. On a blockchain those dollars are stablecoins, tokens designed to hold a value of one US dollar. Our guide to what stablecoins are and how they hold their peg covers the mechanics; here the question is who supplies the money of the stack.
DefiLlama counted about $303.4 billion of dollar-pegged stablecoins in circulation on 27 October 2026, spread over 334 dollar-pegged tokens it tracks. That is more than three times the TVL of all DeFi protocols together, because most stablecoins sit in exchanges, payment flows and wallets rather than in contracts.
| Stablecoin | Issuer or protocol | Circulating, 27 October 2026 (DefiLlama) |
|---|---|---|
| USDT | Tether | $181.84 billion |
| USDC | Circle | $71.19 billion |
| USDS | Sky | $6.80 billion |
| DAI | Sky (formerly MakerDAO) | $4.71 billion |
| USDe | Ethena | $4.57 billion |
| USD1 | World Liberty Financial | $3.92 billion |
| USDG | Paxos (Global Dollar) | $3.07 billion |
| PYUSD | PayPal | $2.91 billion |
| RLUSD | Ripple | $2.59 billion |
| All dollar stablecoins | 334 tracked | $303.4 billion |
Tether’s USDT ($181.84 billion, about 60 percent) and Circle’s USDC ($71.19 billion, about 23.5 percent) supply more than four dollars out of five. Both are fiat-backed: a company issues the token and holds cash and short-term government debt as reserves. DefiLlama classes $275.2 billion of the supply as fiat-backed, $27.5 billion as crypto-backed and $0.66 billion as algorithmic. Sky’s USDS and the older DAI are the largest crypto-backed dollars, minted against collateral deposited in contracts. Ethena’s USDe is a different design built on derivatives, which we explain in layer 4.
This is the first point where DeFi depends on companies outside the chain. A fiat-backed issuer can freeze tokens at a given address, and its reserves sit in banks and funds. The issuers are also among the biggest earners in the whole stack: DefiLlama’s fees table, which counts the income on reserves, shows Tether with $523.6 million and Circle with $211.2 million in the 30 days to 27 October 2026, the two largest lines of all protocols tracked.
Oracles: how a contract learns the price of ETH
A smart contract cannot look at a website. As the Ethereum developer documentation puts it, “Ethereum-based smart contracts cannot, by default, access information stored outside the blockchain network” (ethereum.org). An oracle solves that: a network of operators fetches prices or other data from outside, agrees on a value and writes it on chain, where contracts can read it.
Lending is where this matters most. A lender needs to know, at every moment, whether a borrower’s collateral still covers the loan. If the oracle reports the wrong price, or a price that is out of date, the contract liquidates healthy loans or fails to liquidate bad ones. Several large DeFi losses began with a price that an attacker could push around for a few blocks.
Chainlink is the best-known oracle network. Its website showed a cumulative “transaction value enabled” of about $36.4 trillion, a figure updated on 6 October 2026, which Chainlink defines as the dollar value of all transactions that used one of its oracles (chain.link). That is a running total of activity, not money held, and it is published by Chainlink itself. Pyth Network, which started on Solana and now publishes prices on many chains, and RedStone are other widely used oracle networks. Oracles hold no deposits, so they have no TVL of their own: DefiLlama measures them by the value of the protocols that depend on them, a figure that sits behind a paid API and is not given here.
Layer 3: the primitives, lending and exchanges
The third layer holds the basic financial operations that everything else is assembled from. Borrowing and lending, and exchanging one token for another, are the two big ones. They are often called primitives because the more complex products above are combinations of them.
Lending markets: Aave, Morpho, Spark and Sky
A DeFi lending market is a pool. Depositors put tokens in and earn interest; borrowers take tokens out against collateral worth more than the loan. If the value of the collateral falls too close to the loan, anyone can repay part of the debt and take some collateral at a discount: that is a liquidation, and it is triggered by the oracle price from layer 2. No credit check and no loan officer are involved, which is why the collateral must exceed the loan.
DefiLlama put lending protocols at $51.92 billion of TVL on 27 October 2026. The leaders by family (all versions together):
| Lending family | Main chain(s) | TVL, 27 October 2026 (DefiLlama) |
|---|---|---|
| Aave | Ethereum, Base, Arbitrum and others | $17.45 billion |
| Morpho | Ethereum, Base and others | $11.37 billion |
| Spark | Ethereum | $9.22 billion |
| JustLend | Tron | $6.82 billion |
| Sky vaults (CDP) | Ethereum | $5.28 billion |
| Maple | Ethereum and others | $2.62 billion |
| Compound V3 | Ethereum, Arbitrum, Base and others | $1.35 billion |
Aave is the largest lender in DeFi, with $17.45 billion across its versions and $16.38 billion in Aave V3 alone. Borrowers paid Aave V3 about $36.3 million in fees in the 30 days to 27 October 2026, most of which goes to depositors as interest. Morpho ($11.37 billion) works differently: it offers isolated markets, each with one collateral and one loan asset, and lets specialist managers, which DefiLlama files under “risk curators”, choose markets on behalf of depositors. Spark ($9.22 billion) is the lending arm linked to Sky, the protocol formerly known as MakerDAO, whose own vaults ($5.28 billion in DefiLlama’s “CDP” category) let users mint the USDS stablecoin against collateral. JustLend ($6.82 billion) is the main lender on Tron.
The lending layer is where the stack becomes visible. Look at what a lender holds: stablecoins from layer 2, liquid staking tokens built on layer 1, prices from an oracle, all settled on a chain. Each of those is a dependency.
Decentralised exchanges: Uniswap, PancakeSwap, Aerodrome, Curve
Most decentralised exchanges (DEXs) do not match buyers and sellers in an order book. They use an automated market maker: liquidity providers deposit two tokens into a liquidity pool, and a formula sets the price from the ratio between them. A trader swaps against the pool and pays a fee that goes to the providers. Large orders move the price within the pool, which is the slippage you see in a wallet before you confirm.
DefiLlama’s DEX overview showed about $252.1 billion of volume over the 30 days to 27 October 2026, and $7.98 billion in the last 24 hours. That overview also lists some prediction markets, so the total is wider than pure token swaps.
| DEX family | Where it leads | Volume, 30 days to 27 October 2026 (DefiLlama) |
|---|---|---|
| Uniswap (all versions) | Ethereum and its rollups | $64.4 billion |
| PancakeSwap | BNB Chain | $23.6 billion |
| Aerodrome and Velodrome | Base, Optimism | $16.7 billion |
| PumpSwap | Solana | $14.9 billion |
| Orca | Solana | $7.8 billion |
| Raydium | Solana | $5.7 billion |
Uniswap is by far the largest family, with about $64.4 billion of volume in 30 days, half of it on Uniswap V4, the version that went live on 31 January 2025 and lets developers add custom logic to pools through “hooks”. PancakeSwap leads on BNB Chain, Aerodrome on Base, and PumpSwap, Orca and Raydium on Solana. Curve, built for swaps between assets of similar value such as two stablecoins, is smaller in volume but still holds $1.16 billion in its pools. Volume and deposits tell different stories: DEX pools hold modest sums (Uniswap V3’s pools held $1.59 billion) compared with the trading that runs through them.
Liquid staking, restaking and yield tokens
On proof-of-stake chains such as Ethereum, coins can be staked to secure the network and earn rewards. Liquid staking protocols do the staking for you and hand back a token that represents the staked coin, which keeps its value and can be used elsewhere. DefiLlama put the liquid staking category at $52.56 billion on 27 October 2026, with Lido at $22.35 billion, the largest single protocol in its list, ahead of Binance’s staked ETH ($8.60 billion), ether.fi ($4.41 billion) and Rocket Pool ($1.12 billion).
Restaking goes one step further: already staked coins are pledged again to secure other services, in exchange for extra rewards and extra slashing risk. DefiLlama’s restaking category was $9.50 billion, led by Eigen Labs’ restaking protocol, long known as EigenLayer and listed by DefiLlama as EigenCloud ($5.95 billion), and by Babylon ($3.26 billion), which does the same with bitcoin. Pendle ($1.07 billion for its V2) splits yield-bearing tokens into a principal part and a yield part that can be traded separately. Each of these products takes something from the layers below and turns it into a new token that the layers above accept.
Layer 4: derivatives, perpetual futures and synthetic dollars
Derivatives let users take a position on a price without holding the asset, often with leverage. In DeFi the dominant product is the perpetual future, a contract with no expiry date whose price is kept close to the spot market by periodic funding payments between longs and shorts. These exchanges rely on everything below them: stablecoins as margin, oracle prices to mark positions, the settlement chain to record them, and often lending-style pools to take the other side.
Figures for this layer are thinner. DefiLlama’s derivatives volume and open interest data sit behind its paid API, so we use deposits and fees, which are public.
Hyperliquid is the clear leader. DefiLlama describes it as a layer-1 blockchain best known for perpetual futures and spot trading, and its family of products held about $8.31 billion on 27 October 2026, including its bridge and lending products. Its perpetuals exchange earned about $78.0 million in fees in 30 days, one of the ten largest fee lines in all of DeFi. Behind it, Jupiter’s perpetuals exchange on Solana held $708 million, GMX $207 million and dYdX V4 $69 million. On-chain options remain a niche: Derive, the largest, held $177 million.
Ethena sits where layer 2 and layer 4 meet. Its USDe dollar ($4.57 billion in circulation) is backed by crypto collateral combined with short positions in perpetual futures, so that the two offset each other’s price moves while the position earns the funding rate. It is a stablecoin made out of derivatives, which means it depends on derivatives markets staying liquid and funding rates staying positive, a different risk from a fiat reserve in a bank.
Layer 5: aggregators, wallets and front ends
The top layer is the one you touch. It does not hold much money itself; it decides where your money goes.
Aggregators find the route
A token can trade in dozens of pools on several DEXs at slightly different prices. An aggregator checks them, splits a large order across several pools if that gives a better result, and sends it in one transaction. DefiLlama tracked about $64.6 billion of aggregator volume in the 30 days to 27 October 2026, and $1.83 billion in the last 24 hours.
| Aggregator | Volume, 30 days to 27 October 2026 (DefiLlama) |
|---|---|
| Jupiter | $12.66 billion |
| DFlow | $8.56 billion |
| 0x | $5.97 billion |
| OKX Swap | $5.97 billion |
| KyberSwap | $5.19 billion |
| 1inch | $3.10 billion |
| All aggregators | $64.6 billion |
Jupiter, on Solana, led with $12.66 billion in 30 days, followed by DFlow (also on Solana), 0x, OKX Swap, KyberSwap and 1inch. Some aggregators are built into wallets, so a user may never visit them directly.
Wallets and front ends are the door
A wallet such as MetaMask, Phantom or Trust Wallet holds your keys, shows your balances and asks you to sign transactions; our guide to how crypto wallets work covers the basics. The website of a protocol, its front end, builds the transaction that the wallet signs. The contracts may be decentralised, but the website is usually run by a company, on ordinary web hosting, under a domain name. It can be taken down, blocked in some countries, or hijacked so that it asks users to sign a malicious transaction. Many DeFi losses happen at this layer, through fake sites and harmful approvals, not through broken contracts.
That is also where the rules reach. In the United States, staff of the SEC’s Division of Trading and Markets published a statement on 13 April 2026 on “covered user interfaces”: websites, browser extensions or apps that help users carry out transactions in crypto asset securities from their own self-custody wallets (SEC staff statement). The staff said such providers would not need to register as broker-dealers if they meet conditions, among them a fixed charge paid by the user and not by third parties (no payment for order flow), no recommendations or solicitation of trades, no custody of user funds, and no execution, settlement or routing of orders. The statement says it has no legal force, and it will be considered withdrawn five years after 13 April 2026 unless the Commission acts first.
On taxes, Congress overturned the IRS rule that would have required DeFi front ends to report users’ sales as brokers. The resolution, H.J.Res.25, passed the House 292 to 132 and the Senate 70 to 28 and was signed on 10 April 2025, according to the House Ways and Means Committee. That removed a reporting duty; it did not remove tax. Gains on DeFi trades are still taxable for US users, as explained in our guide to crypto taxes in the United States.
Composability: why the stack is useful
The layers of the DeFi stack plug into each other without permission. A developer does not need a contract with Aave to accept Aave deposit tokens, or with Lido to accept staked ether. Developers call this composability; the popular image is “money legos”. Ethereum’s DeFi page makes the same point in its own words when it says protocols can be mixed and matched (ethereum.org).
Follow one deposit through the stack to see what that means. A user stakes ETH with Lido and receives stETH (layers 1 to 3). They deposit the stETH on a lending market as collateral and borrow USDC against it (layers 2 and 3). They put the USDC into a yield product such as a Pendle market, or use it as margin on a perpetuals exchange (layers 3 and 4). All of it can happen from one wallet, through one front end or aggregator (layer 5), in a few minutes. The same ether now earns staking rewards, backs a loan and funds a position.
For builders, composability means a new protocol can launch with a fraction of the code a bank would need, because the exchange, the dollar and the price feed already exist. For users, it means services that would take accounts at three institutions are a few clicks apart.
Risk stacking: when one layer fails, the layers above feel it
The same property works in reverse. Every layer inherits the risks of the layers below it, and adds its own. In the deposit we just followed, the user is exposed at once to Ethereum, to Lido’s contracts and validators, to the stETH price, to the lending protocol’s code, to the oracle that prices stETH, to USDC’s issuer, to the yield or perpetuals protocol, and to the website they used. One failure anywhere in that chain can reach them.
| Layer | What can go wrong | Who feels it |
|---|---|---|
| Settlement | The chain halts, gets congested or a bridge is drained | Every protocol on that chain, and every token bridged from it |
| Money and data | A stablecoin loses its peg or is frozen; an oracle reports a wrong price | Lenders holding it as collateral, pools trading it, liquidations based on the price |
| Primitives | A contract bug, bad collateral, a wave of liquidations | Depositors, and the protocols that hold its tokens |
| Derivatives | Sharp moves force liquidations faster than the market can absorb | Traders, liquidity pools that take the other side, synthetic dollars built on hedges |
| Interfaces | A website is hijacked, a user signs a harmful approval | The users of that front end, even when the contracts are sound |
| Governance (all layers) | A vote or an admin key changes parameters or code | Everyone who uses the protocol, and everyone built on it |
History shows how this travels. When the TerraUSD stablecoin lost its peg in May 2022, the damage did not stop at Terra: protocols and funds that held it as collateral or reserves were hit too. Bridges, which hold large pools of locked tokens, have been the target of some of the largest thefts in the sector. Our history of DeFi goes through those episodes with dates and amounts.
Concentration adds to the effect. On 27 October 2026, one issuer supplied about 60 percent of all stablecoins, one chain held about 55 percent of DeFi deposits, and three lending families (Aave, Morpho, Spark) held about $38 billion between them, according to DefiLlama. A serious problem at any one of them would not stay inside its own layer.
None of this means the stack must fail. It means that the risk of a DeFi position is the sum of the risks of every layer it touches, and the protocol whose name is on the screen is just one of them. Most of those risks cannot be seen from the interface. Our guide to spotting and avoiding crypto scams covers the most common traps at the top layer, from fake websites to drainer approvals.
How to place any new protocol on the map
The map is useful because it turns a new name into a set of questions. When you meet a protocol you have never heard of, these five questions locate it and show what it depends on. They are a reading method, not investment advice.
- Which layer does it belong to? A chain, a dollar or price feed, a lender or exchange, a derivatives market, or an interface that routes to others.
- Which pieces below does it rely on? The chain it settles on, the stablecoins it accepts, the oracle it reads, the protocols whose tokens it holds.
- Who can change it? Whether the contracts can be upgraded, by whom, with what delay, and whether a small group holds admin keys.
- Where are the assets, and for whom? Your own assets in your wallet, deposits in its contracts, or reserves held by a company off chain.
- How do you get out? Whether withdrawals are instant, queued or can be paused, and what happens to your position if a layer below stops.
Figures help with the first question too: the size of a protocol’s deposits, its volume and the fees it earns tell you whether it is a leader or a niche product in its layer. Those numbers have their own traps: a later lesson of this course, on measuring TVL, volumes and revenue, takes them apart one by one.
