What are the biggest risks of DeFi?

DeFi's risks fall into a few distinct buckets, and it helps to separate them because they demand very different mitigations:

Smart-contract risk — the core one. Funds are held by code, not a bank, so a bug or exploit in a protocol's contract can drain everything. Even audited protocols get hacked (that's why TVL shrinks after incidents). This is what the term "not your keys, not your coins" doesn't cover — your keys are yours, but the contract is the custodian in disguise.

Liquidity / bank-run risk — many protocols rely on liquidity pools. In a sharp downturn, liquidity can dry up faster than people can withdraw, causing cascading liquidation of leveraged positions. This amplifies drawdowns relative to spot markets.

Over-collateralization and liquidation risk — on lending platforms, if your collateral value drops past a threshold, you get liquidated and lose a chunk of it. It's mechanical and unforgiving: there's no human underwriter to cut you slack.

Bridge risk — cross-chain bridges are historically the biggest single source of DeFi hacks. The bridge contract is a concentrated target holding value on both sides, so the blast radius is large.

Protocol / governance risk — changes to parameters or even malicious governance proposals can alter a protocol's behavior. Admin keys, upgradeable proxies, and protocol-owned funds are all ways "decentralized" systems can still behave in centralized ways.

Impermanent loss — on AMMs, providing liquidity while prices move can net you less than simply holding both tokens, because of the arbitrage that keeps the pool balanced. It's not a hack — it's a structural cost of LPing.

Regulatory and counterparty risk — the "DeFi" wrapper doesn't fully remove legal exposure; frontends, stablecoin issuers, and token issuers can be regulated or shut down, and some protocols have a real, identifiable team behind them.

The common thread: DeFi's promise is that code replaces intermediaries, but that shifts risk onto you to verify the code, the liquidity, the lock, and the governance. That's exactly why on-chain checks matter — liquidity-lock status, mint/freeze authorities, honeypot flags — before anyone puts value into a new pool.

Want me to make this concrete? I can pull the current state of a specific protocol or token (liquidity lock, contract security flags, live TVL/volume) so you can see how these risks actually look on-chain rather than in the abstract.