On 1 April 2026 a Solana trading protocol that called itself decentralised lost about 285 million dollars in roughly twelve minutes. No line of its code was broken. Two of the five people on its Security Council had been tricked days earlier into signing transactions they did not understand, and that was enough to hand an attacker the keys. On 28 October 2026, swapping a few hundred dollars of USDC for ether on Base cost about a quarter of a cent in network fees and settled in about two seconds. Both stories are DeFi, and a fair DeFi vs CeFi comparison has to explain each of them.
There is also a third option people forget when they compare the two: the bank and the broker. The marketing version says DeFi is non-custodial, open, transparent, permissionless and always on, while centralised exchanges and banks are closed and slow. Each of those five claims holds some truth. Each also has a weak spot that the pitch leaves out.
Below, the five properties are tested one by one against a centralised exchange such as Coinbase, Binance or Kraken, and against a bank or a broker. Then comes one transaction, 500 dollars of USDC turned into ether exposure, through three different doors, with the fees measured on 28 October 2026. The questions to carry away work for any financial product: who can move or freeze my money, who can change the rules, and what do I see before I sign?
Three kinds of finance, in one paragraph each
A short reminder first. DeFi means lending, trading and saving through smart contracts on a public blockchain, with your own wallet and no company holding the funds in between; our guide what DeFi is and how it works has the full definition. A smart contract is a program stored on the chain that runs exactly as written when someone calls it.
CeFi, centralised finance, is crypto run by a company. An exchange like Coinbase, Binance or Kraken opens an account for you after identity checks, keeps the coins in its own wallets, and matches buyers and sellers in a private order book. The mechanics, from the order book to cold storage, are covered in how centralised exchanges work, so we will not repeat them here.
TradFi, traditional finance, is the world of banks and brokers. Your money is a deposit, which legally is a loan you make to the bank. Your shares sit at a broker. Both are covered by long-standing deposit and securities law, by supervisors such as the SEC and FINRA in the United States or the FCA in the United Kingdom, and by protection schemes that pay out when the institution fails.
| DeFi (protocol + your wallet) | CeFi (crypto exchange) | TradFi (bank + broker) | |
|---|---|---|---|
| Who holds the asset | You, through your private key | The exchange, in its wallets | The bank (deposit) or the broker’s custodian (securities) |
| What you own | The token itself | A claim on the exchange | A claim on the bank, or shares held for you |
| Who can freeze it | The token issuer (for USDC or USDT), not the protocol in most cases | The exchange, regulators, courts | The bank, regulators, courts |
| Who supervises | Nobody directly; front ends and issuers are regulated in places | Crypto regulators (MiCA in the EU, state and federal rules in the US) | Banking and securities regulators |
| Opening hours | The chain runs continuously, barring outages and pauses | Trading 24/7, support and fiat rails on office hours | Market hours, with settlement on business days |
| Failure protection | None | None for crypto in the US deposit or broker schemes | FDIC up to 250,000 dollars, SIPC up to 500,000 dollars (US) |
The five DeFi properties, tested one by one
The five properties below are a common way of describing DeFi, not an official standard. Treat each as a dial rather than a switch: a given protocol can be fully non-custodial and barely permissionless at the same time.
Non-custodial: you hold the key, and the whole risk
In DeFi the asset sits at an address only your private key can sign for. A lending pool or an exchange contract never “has” your account; you send it tokens when you choose, and the contract’s rules decide what you get back. This is self-custody, and it is the clearest line between DeFi and CeFi.
On a centralised exchange your screen shows a balance, but the coins are in the company’s wallets. What you hold is a promise. When the company is honest and solvent, the difference is invisible. When it is not, it becomes the whole story: Celsius froze withdrawals in June 2022 and FTX filed for bankruptcy that November, and customers became creditors waiting for a court. Our history of DeFi covers both collapses.
A bank deposit is also a promise, but a protected one. The FDIC insures 250,000 dollars per depositor, per insured bank, per ownership category, and states on its site that crypto assets are not covered, even when bought through a bank. At a failed broker, SIPC protects up to 500,000 dollars, of which 250,000 in cash. It replaces missing securities; it does not cover a fall in their value, and it does not cover crypto that is not a registered security.
Where self-custody is weaker than it sounds: nobody can freeze your wallet, and nobody can restore it either. Lose the seed phrase or sign a malicious approval and the funds are gone, with no help desk and no insurance. The key also protects only the wallet. The tokens inside can still carry an issuer’s freeze button, as the USDC section below shows.
Open source and composable: readable code, not always fixed code
Most DeFi contracts are published and verified on block explorers, so anyone can read what the code does, copy it or build on top of it. That last point, protocols plugging into each other like building blocks, is called composability and gets its own treatment in a later lesson on money legos. An exchange’s matching engine or a bank’s core system, by contrast, is closed: you trust audits you will never see.
Readable is not the same as unchangeable. Many protocols use upgradeable contracts, where an admin can point the address to new code. Base, the layer 2 network developed by Coinbase, shows the nuance. L2BEAT rates it Stage 1, which means fraud proofs let outsiders challenge a bad state. Yet the same page, checked on 28 October 2026, gives Base an exit window of “None” because its “contracts are instantly upgradable”: an upgrade needs only the approval of the Base Coordinator Multisig and the Base Security Council, and users get no time to leave first. If you need a reminder of why layer 2 networks exist at all, see layer 1 vs layer 2.
So the useful question is not “is it open source?” but “who can change this code, and how much warning do I get?”. A timelock of several days lets users leave before an upgrade lands. No timelock means you are trusting the people who hold the keys.
Transparent: every transaction is public, the risks are not
Every swap, loan and liquidation in DeFi is written on a public ledger. Explorers such as Etherscan or Basescan show each transaction, and dashboards such as DefiLlama add up the totals: as of 28 October 2026 the chains it tracks held 88.69 billion dollars in DeFi protocols, 46.21 billion of it on Ethereum and 6.13 billion on Base. That total is a sum of chain figures, and our lesson on how to measure DeFi TVL explains why it needs care.
A centralised exchange publishes what it chooses to publish: sometimes a proof of reserves, sometimes nothing. A listed bank or broker files audited accounts every quarter, under rules that decide what must be disclosed. Neither lets you watch the ledger in real time.
Where transparency is weaker than it sounds: public data is not the same as understood data. The Drift multisig settings, two signatures out of five and no delay, were visible on chain before April 2026; very few users read them. Transparency also cuts both ways for privacy. Your wallet is pseudonymous, not anonymous: once one address is linked to your name, through an exchange withdrawal for example, your whole history can be read by anyone.
Permissionless: anyone can call the contract, not everyone gets through the front door
No one approves you before you call a smart contract. No account, no identity check, no country list at the protocol level. That is a real difference from an exchange, which must verify customers, and from a bank, which can close an account without saying why.
The weak spots are around the contract rather than in it. Most people reach DeFi through a website, and websites are run by companies. The Uniswap Labs app had already blocked addresses on the US sanctions list for years when, in April 2022, it started blocking addresses linked to stolen funds or ransomware too, using screening from TRM Labs. The company was careful to say the protocol itself was not changed, and that “we do not control users’ access to it via any portal other than our own app” (Uniswap Labs blog, 19 April 2022). The contracts stay open; the most used door has a guard.
The second choke point is the asset. Stablecoins such as USDC and USDT are issued by companies that can block addresses, and governments can sanction code itself, as the Tornado Cash case showed. Both are covered in the next section.
Open 24/7: the chain never closes, unless someone pauses it
A blockchain does not keep office hours. Base produces a block every two seconds, Ethereum every twelve, at weekends and on public holidays alike. Crypto exchanges trade around the clock too, though their fiat deposits and support teams still follow banking days. A US stock order placed on a Saturday waits for Monday, and the shares settle one business day after the trade, the T+1 cycle the SEC adopted and applied from 28 May 2024.
Where “always on” is weaker than it sounds: layer 2 networks depend on a sequencer that can stall, and many protocols have pause buttons held by a guardian or a multisig. On Aave, for instance, one guardian multisig can veto a governance payload it judges malicious, and another holds the emergency role that can pause markets. A pause can protect users during an attack. It is also, by definition, a group of people who can stop the service.
| Property | DeFi claim | Centralised exchange | Bank or broker | Where the claim is weaker |
|---|---|---|---|---|
| Non-custodial | You hold the key | The exchange holds the coins | The bank holds the deposit | No recovery; tokens can carry an issuer freeze |
| Open source | Code readable and reusable | Closed systems | Closed systems | Upgradeable contracts, some without delay |
| Transparent | Every transaction public | Partial, by choice | Audited filings, delayed | Data is public but rarely read; privacy suffers |
| Permissionless | No sign-up | Identity checks | Identity checks | Front ends block addresses, issuers freeze tokens |
| 24/7 | Blocks every few seconds | Trading 24/7, fiat on business days | Market hours, T+1 in the US | Sequencer outages and pause powers |
Where decentralisation stops: admin keys, issuers and the law
The five properties all lean on one thing: that nobody in particular is in charge. In practice there is usually someone, and the cases of 2025 and 2026 show where.
Admin keys: two signatures were enough at Drift
At Drift, a perpetual futures exchange on Solana, the admin powers sat with a Security Council: a 2-of-5 multisig with no timelock. According to the analysis BlockSec published on 3 April 2026, it was a multi-week operation: the attacker got two signers to pre-sign transactions through phishing or misleading signing requests. The signers’ keys were never stolen. A Solana feature called durable nonces kept those signatures valid until the attacker chose to use them on 1 April. With admin rights, the attacker listed a worthless token as collateral, fed it a fake price through an oracle under their control, and withdrew real assets in 31 transactions over about twelve minutes. BlockSec puts the loss at about 285.3 million dollars.
Four weeks later the same pattern struck at a smaller scale. On 30 April 2026 Wasabi Protocol, a trading protocol on Ethereum and Base, lost about 4.55 million dollars, CoinDesk reported. A single ordinary wallet held the only admin role, with no multisig and no timelock. Once its key was compromised, the attacker granted themselves admin rights and upgraded the vaults to code that drained them. CoinDesk counted more than 770 million dollars lost in DeFi across more than 30 incidents in 2026 at that date.
Centralised platforms are not immune. On 21 February 2025 the exchange Bybit lost about 1.5 billion dollars in ether, a theft the FBI attributed to North Korea in a public notice five days later. Custody moves the risk; it does not remove it. On an exchange a hack is first the company’s loss, while in DeFi it lands on whoever had funds in the contract.
USDC and USDT: the freeze button inside the token
USDC is issued by Circle, USDT by Tether; both are covered in our guide to what stablecoins are. Their smart contracts include a blacklist. Circle’s USDC terms say it “reserves the right to block the transfer of USDC to and from an address” under its blocklisting policy, and that it may be required to freeze USDC when it receives “a legal order from a valid government authority”. Holding USDC in your own wallet makes you non-custodial for the key, not for the token.
A case from 2026 shows how wide that power reaches. On 30 May 2026, after a temporary restraining order from a federal judge in the Northern District of California, Circle blacklisted the Ethereum contract behind Zama’s confidential USDC wrapper, freezing 12,606,386 USDC, The Block reported from the on-chain blacklist transaction. The order came from a civil suit, Newton AC/DC Fund v. Ermilov, in which investment funds allege that a DeFi founder diverted treasury funds; he disputes the claims. Zama was not a party. Because the wrapper was a shared pool, every depositor was locked out along with the disputed deposit, and Zama paused its wrappers. After a hearing on 1 June the court lifted the freeze, Zama said the next day: about three days of lockout for users who had nothing to do with the dispute.
Tornado Cash: when a government sanctions code
Tornado Cash is a mixer on Ethereum that breaks the link between deposits and withdrawals. On 8 August 2022 the US Treasury’s sanctions office, OFAC, added it to the sanctions list, which made it illegal for US persons to use the contracts and pushed front ends and infrastructure providers to cut it off.
The courts then pulled in different directions. On 26 November 2024 the Fifth Circuit Court of Appeals ruled in Van Loon v. Department of the Treasury that Tornado Cash’s immutable smart contracts are not “property” that sanctions law can block. On 21 March 2025 the Treasury removed the sanctions, citing its review of “the novel legal and policy issues” raised by sanctions on evolving technology. The criminal case went on separately: in August 2025 a jury convicted co-founder Roman Storm on one count, conspiracy to operate an unlicensed money-transmitting business, and could not agree on the money-laundering and sanctions counts. As of a report by The Block on 26 August 2026, his motion for acquittal was still undecided and a retrial on the two open counts was set for 26 April 2027.
The law: rules aim at intermediaries, and DeFi still has some
Regulators mostly write rules for intermediaries, and pure DeFi tries to have none. In the European Union, MiCA licenses crypto-asset service providers. Its recital 22 says that where crypto-asset services are provided “in a fully decentralised manner without any intermediary”, they should not fall within its scope. The door is narrower than it looks. A recital explains the law; it is not an operative article. MiCA never defines “fully decentralised”. And the same recital says the rules still apply when only part of an activity is performed in a decentralised manner. It is a carve-out with a narrow door, not a general exemption for DeFi. Our guide MiCA regulation explained covers the rest.
US regulators split the work by activity: the SEC handles securities, the CFTC commodities and derivatives, and a DeFi front end can fall under either. On taxes, Congress went the other way in 2025: a resolution signed on 10 April 2025 (H.J.Res.25) overturned the IRS rule that would have required DeFi “brokers” to file Form 1099-DA, according to the House Ways and Means Committee. That removes a reporting duty on DeFi platforms. It does not remove your own duty to report gains, which our US crypto tax guide explains.
One swap, three doors: 500 dollars of USDC into ether
Now the practical side of DeFi vs CeFi. Say you hold 500 dollars, or 500 USDC, and you want exposure to ether. At about 09:45 UTC on 28 October 2026 ether traded near 2,369 dollars, per DefiLlama’s price feed, so 500 dollars buys roughly 0.211 ETH before costs. Here is the same purchase through each door.
Door 1: Uniswap on Base, from your own wallet
You need a self-custody wallet holding USDC on Base and a small amount of ETH on Base to pay gas. That last point catches many beginners: without a little ETH on the right network you cannot move anything. Getting funds onto Base, by withdrawing from an exchange directly to Base or by using a bridge, is the subject of our previous lesson on cross-chain bridges and intents.
On the app of Uniswap you pick USDC and ETH, check the token contract addresses, and read the quote: the amount of ETH, the price impact and the network fee in dollars. The first time, your wallet asks you to approve the Permit2 contract to spend your USDC. That approval is a standing permission; it is worth revoking later with a tool such as Revoke.cash once you no longer need it. Then you sign the swap.
Who holds the money at each step: you, until the transaction executes, and then you again, with ETH in place of USDC. In this door you use a decentralised exchange, a set of contracts with no company in the middle of the trade. The pool contract holds the other side of the trade. Nobody at Uniswap Labs touches your funds.
The costs, measured on 28 October 2026. The network fee: twelve recent Uniswap router transactions on Base around 09:50 UTC used between 186,000 and 204,000 units of gas, at a gas price near 0.006 gwei, and cost between 0.002 and 0.003 dollars each, layer 1 data fee included, according to our own queries of a public Base node. Ethereum mainnet costs more, and moves more. At the 0.224 gwei gas price we read there at about 09:50 UTC, and assuming the same 180,000 or so units of gas, our own calculation gives roughly 0.10 dollars for the swap; by 10:06 UTC the gas price had dropped to 0.13 gwei, which brings the same swap near 0.05 dollars. In busy periods it can be many times that. The pool fee: Uniswap v3 pools charge 0.01%, 0.05%, 0.3% or 1% depending on the pool, so between 0.25 and 1.50 dollars on 500 dollars in the usual ETH/USDC tiers. The interface fee: Uniswap Labs said in its November 2025 “UNIfication” proposal that it would turn off its interface, wallet and API fees, and Uniswap governance approved the proposal that December; check the quote screen, which lists any fee.
Settlement: the swap is final on Base in the next block, about two seconds later. Do not confuse that with a withdrawal from Base back to Ethereum, which L2BEAT lists with a five-day challenge period.
What can go wrong: a fake token with the same name as USDC or ETH, a phishing copy of the Uniswap site, an approval signed on a malicious site, slippage on a thin pool, a frozen USDC address, or a lost seed phrase. A failed transaction still costs gas, though on Base that is a fraction of a cent.
Door 2: a centralised exchange, from your account
You open an account and pass identity checks. You deposit 500 USDC, either from a wallet (an on-chain transfer that needs confirmations) or by buying it with dollars from your bank. You place a market order for ETH. The order fills in milliseconds in the exchange’s internal order book. Nothing touches the blockchain: the trade is an entry in the exchange’s database, and your new ETH appears as a balance.
Who holds the money: the exchange, from the moment your deposit is credited until you withdraw. If you want to hold the ETH yourself, you withdraw it to your wallet and pay the withdrawal fee the exchange sets.
The trading fee, from the public schedules on 28 October 2026: on Binance, regular users pay 0.1% maker and taker on spot, less when paying fees in BNB, so about 0.50 dollars on 500 dollars. On Kraken, the entry tier of Kraken Pro charges 0.40% maker and 0.80% taker, between 2 and 4 dollars on 500, while instant buys in the simple app cost 1% plus a spread. Coinbase publishes its own schedule; check it in the app before you trade, as fees depend on the product and the payment method.
What can go wrong: withdrawals suspended during a crisis, an account frozen for compliance review, a hack of the exchange, an insolvency, or a region where the exchange stops serving customers. On the other hand, a forgotten password is a support ticket, not a lost fortune.
Door 3: a bank and a broker, through a spot ether ETF
Here one detail matters. A normal bank cannot convert USDC: it handles dollars. The bank and broker route therefore starts with 500 dollars in a bank account and ends with a share of a spot ether exchange-traded fund, not with ether. In the United States, spot ether ETFs started trading in 2024. The iShares Ethereum Trust, ticker ETHA on Nasdaq, charges a sponsor fee of 0.25% a year according to its product page, which is 1.25 dollars a year on 500 dollars.
The steps: you move dollars from your bank to a brokerage account by ACH or wire, you place an order for ETF shares during market hours, and the shares are delivered to your account one business day later. Your broker may charge a commission or none; check its schedule. The fund holds ether with a custodian. The broker holds your shares in its name on your behalf. You hold a claim on the broker, covered by SIPC if the broker fails.
What you get is exposure, not ownership. You cannot send the ETF’s ether to a wallet, lend it, stake it yourself or use it in a DeFi app. In exchange you get no keys to lose, no gas, a familiar tax form and a legal framework tested over decades. What can go wrong: the share price can drift from the value of the ether held, trading can be halted, and orders placed outside market hours wait for the open.
The three doors side by side
| On 28 October 2026 | Uniswap on Base | Centralised exchange | Bank + broker (ETF) |
|---|---|---|---|
| You end up with | About 0.21 ETH in your wallet | About 0.21 ETH as an account balance | ETF shares worth about 500 dollars of ether |
| Who holds it | You | The exchange | A custodian for the fund; your broker for the shares |
| Network fee | 0.002 to 0.003 dollars | None for the trade itself | None |
| Trading fee on 500 dollars | 0.25 to 1.50 dollars (pool fee) | About 0.50 dollars (Binance), 2 to 4 dollars (Kraken Pro) | Broker commission, if any, plus 0.25% a year |
| Speed | About 2 seconds | Milliseconds once funded | Market hours, settlement T+1 |
| Identity check | None at the protocol | Required | Required |
| Main risks | Your own mistakes, scams, issuer freeze | Freeze, hack, insolvency | Market loss, tracking error, trading halts |
DeFi vs CeFi vs a broker: match the door to the job
The cheapest door on a given day is not the point, because the fees change with gas prices, pool depth and your trading volume. A better approach is to match the door to the job.
If you need to keep the asset under your own control and use it in other protocols, DeFi is the only door that allows it. The price is that every mistake is yours to bear.
If you want a phone app, customer support, dollar deposits and withdrawals, and you accept that a company holds your coins, a centralised exchange does the job, provided it is licensed where you live and you do not leave more on it than you need for trading.
If all you want is price exposure inside an existing brokerage or retirement account, with familiar tax paperwork, a spot ETF gives that, at the cost of never touching the asset.
In practice DeFi vs CeFi is rarely an either-or, and most people end up using two doors: an exchange or a bank to move between dollars and crypto, and a wallet for what they want to hold or use on chain. Nothing here is a recommendation to buy ether or any other asset.
Rules that change the picture for US and UK readers
In the United States, the protections stop at the edge of traditional finance. FDIC insurance covers deposits, not crypto, and SIPC covers missing securities at a failed broker, not crypto held at an exchange or in a wallet. The SEC and the CFTC supervise securities and derivatives; a crypto exchange may also hold state licences. The IRS treats digital assets as property, not currency, so each swap in a wallet or on an exchange can be a taxable disposal; the DeFi broker reporting rule was repealed in April 2025, but your own reporting duty remains.
In the United Kingdom, the FCA’s consumer page on crypto (updated 29 January 2026) says crypto is largely unregulated in the UK and that it is “highly unlikely” you would be covered by the Financial Services Compensation Scheme for crypto losses. As everywhere, a DeFi protocol itself has no licence, while the company running a front end may be in scope. For EU readers, the last MiCA transition periods ended on 1 July 2026: a centralised exchange now needs a MiCA licence to serve customers in an EU country.
Mistakes people make when they move from CeFi to DeFi
Most losses at this stage come from habits carried over from apps where a help desk could undo mistakes. A few rules cover most of them.
- Try the swap first on a testnet such as Sepolia, where tokens are free, so that the approval and signature screens look familiar before real money is involved.
- Start with a small amount on mainnet and keep a little ETH for gas on the network you use.
- Open the app from a bookmark or the project’s official site, never from an ad or a link in a direct message.
- Copy token contract addresses from the issuer’s or the project’s own documentation, and compare them on the confirmation screen.
- Read what you sign: an approval with an unlimited amount for an unknown contract is the most common way wallets get emptied.
- Revoke old approvals regularly, and keep your seed phrase offline and out of any photo or cloud note.
- Before depositing in a protocol, look up who can upgrade or pause it and whether a timelock exists; L2BEAT does this for layer 2 networks, protocol docs for the rest.
What to read next
For the definition and the building blocks, go back to what DeFi is. If the exchange side is the part you use most, how centralised exchanges work goes deeper into custody and order books. The next lesson of this path looks at composability: what happens when DeFi protocols are stacked on top of each other, and why that creates both yield and chains of risk.
