Is it safe to lend crypto?

TL;DR. Lending crypto is not safe the way an insured bank deposit is: US deposit insurance does not cover crypto assets, and every way of lending can lose the amount you lent. What differs is who can lose it for you: a company holding your coins, a shared pool whose collateral fails, or one borrower who does not repay. Before funding anything, check where the money sits, who can change the rules, how you exit, and whether the rate covers the defaults you assume.

Is it safe to lend crypto?

Lending crypto is never risk-free. How the principal, the amount lent, can be lost depends on who holds the money: a custodian (a company holding your assets), a shared pool or a single borrower.

Lending crypto means handing a crypto asset, often a stablecoin (a token designed to track a currency such as the US dollar), to one of those three in exchange for interest. The US FDIC said in a fact sheet dated 28 July 2022 that deposit insurance does not cover crypto assets or the failure of non-bank crypto companies. Deposit protection differs by country.

DeFi (decentralized finance) means financial services, here lending, run by smart contracts, programs on a blockchain that hold and move funds by public rules. CeFi (centralized finance) means the same service run by a company. A pool is a contract that blends many lenders' deposits. Over-collateralized means the borrower locks collateral worth more than the loan, and under-collateralized means less than the loan, or none. In peer-to-peer crypto lending, each lender funds a specific borrower's loan through a smart contract, with no pool in between.

This article is general education, not financial, legal or tax advice, and it recommends no platform or allocation. Rules on lending, deposit protection and tax vary by jurisdiction.

What can actually go wrong when you lend crypto?

Six things can go wrong when you lend crypto: the custodian fails, a contract is exploited, collateral turns out to be worth less than the debt, the pool has no liquidity when you want out, the stablecoin loses its peg, or the borrower does not repay.

• Custodian failure. The custodial lender Celsius paused withdrawals on the evening of 12 June 2022 (US time) and filed for Chapter 11 bankruptcy a month later.
• Exploit. An exploit is an attack that uses a flaw in a contract or its dependencies to take funds. The lending protocol Euler Finance lost $197 million on 13 March 2023, and by 4 April 2023 the attacker had returned more than $177 million.
• Bad debt. Bad debt is the part of a loan that the collateral no longer covers. The lending protocol Aave was left with about $1.6 million of it in November 2022 after a trader borrowed 92 million CRV tokens and sold them, the price of CRV rose, and liquidation, the sale of collateral to repay the debt, fell short. A proposal followed to cover it from an insolvency fund and Aave's treasury.
• Liquidity freeze. A liquidity freeze is a period when a pool has lent out everything it holds and cannot pay withdrawals, as happened on Aave for at least four days in April 2026.
• Depeg. A depeg is a stablecoin trading away from the currency it tracks. USDC fell below $0.90 on 11 March 2023 after its issuer disclosed $3.3 billion of reserves at the failed Silicon Valley Bank, and a Federal Reserve note records a full recovery on 13 March.
• Borrower default. A default is a borrower failing to repay as agreed. The trading firm Orthogonal Trading defaulted on $36 million of loans on Maple Finance, an institutional lending protocol, in December 2022.

Is lending through a centralized platform safer than DeFi?

Lending through a centralized platform is not inherently safer than DeFi: where the platform's terms transfer title (legal ownership) to the company, as those of the custodial lender Celsius did, you can become an unsecured creditor, a claimant with no right to any specific asset. What a centralized platform offers in return is fiat access, customer support and a legal entity to pursue.

A US bankruptcy court in New York held on 4 January 2023 that the crypto in roughly 600,000 Celsius Earn accounts, valued at about $4.2 billion shortly before the company's July 2022 bankruptcy filing, belonged to the bankruptcy estate, because the terms of use transferred title to Celsius. Account holders were left with general unsecured claims. That was one US court reading one company's terms, and other terms and jurisdictions can differ, so the clause to read on any custodial platform is the one on who holds title to deposited assets.

Is lending on Aave or another pooled protocol safe?

Lending on Aave or a similar over-collateralized pool puts collateral behind every loan and normally lets a lender withdraw on demand, but it is not risk-free even when the pool's own code has no bug. Collateral that proves worthless, or a borrowed asset that rises faster than collateral can be sold, leaves bad debt someone must absorb, and when every deposit is lent out (100% utilization) you cannot withdraw until borrowers repay or new deposits arrive.

What the April 2026 rsETH incident showed

The April 2026 rsETH incident showed that a pool lender can take bad debt from any collateral that can be used to borrow the asset they supplied, and can be locked in when other users rush to withdraw.

On 18 April 2026 an attacker drained about 116,500 rsETH, a token issued by Kelp DAO, through its cross-chain bridge, the contract that moves the token between blockchains. According to LlamaRisk's 20 April incident report, co-authored by Aave service providers, Aave's own contracts were not compromised, but 89,567 of those rsETH were deposited on Aave and 82,650 WETH (wrapped ether) was borrowed against them. The report modeled bad debt of about $123.7 million or $230.1 million, depending on how the shortfall was allocated, and found WETH reserves at 100% utilization on five of Aave's markets.

Stablecoin lenders were caught too. Kiln, whose products deposit into Aave, recorded on 23 April that USDC, USDT and USDe on Aave's main Ethereum market had sat at about 100% utilization for four days and that withdrawals could fail or fill partially. Liquidity returned by 4 May.

CoinDesk reported on 18 May that more than 95% of the rsETH left without backing had been recovered, with an industry coalition, DeFi United, expected to cover the rest, and on 26 May Cointelegraph reported Kelp DAO's statement that the operational part of the recovery was closed. We have found no public final accounting of what, if anything, Aave lenders ultimately bore.

A backstop, a fund that takes losses before ordinary lenders, helps but is finite. LlamaRisk's report sized the WETH module of Umbrella, the backstop launched in June 2025 to replace Aave's Safety Module, at about $54 million for Aave's main Ethereum market, against modeled WETH bad debt there of about $91.8 million in one scenario and none in the other. On 20 April 2026 Aave Labs proposed pausing that module while the shortfall was assessed.

This account of the incident relies on sources published between 18 April and 26 May 2026.

Does lending to one borrower instead of a pool protect you from other people's defaults?

Lending to one borrower in an isolated loan protects you from other people's defaults, but not from your own borrower's. If your borrower defaults, no pool or backstop absorbs any of the loss, and you usually cannot withdraw until the borrower repays.

Isolated peer-to-peer lending is the model we are building at Unlloo, where a crowd loan is one loan funded by many independent lenders. Designing the lender side meant accepting three costs a pool does not have: no exit before repayment, an offer that sits unlent in the loan's contract until the borrower accepts it or it is refunded, and exposure concentrated on one borrower.

What those costs buy is a counterparty (the other side of the loan) you chose, at a rate you offered within the borrower's cap. Aave itself began as ETHLend, a peer-to-peer market, and moved to pooled liquidity, which removes the wait for a counterparty, as Finematics recounts.

Isolation protects the people outside a loan, not those inside it.

How many defaults can an interest rate absorb?

At an interest rate r for the whole term and zero recovery, a set of equal loans breaks even when the share that defaults equals r / (1 + r): 13.0% at a 15% rate, 9.1% at 10% and 16.7% at 20%. A rate quoted as an APR (annual percentage rate) has to be converted to the term first.

These are invented numbers, not observed rates or sizing advice.

What has happened to lenders in unsecured crypto loans so far?

The public record of lenders in unsecured and under-collateralized crypto loans, meaning loans with no collateral or with less than the loan is worth, is short: pools that lent to companies this way took defaults in 2022, Maple Finance later largely moved to over-collateralized lending, and one lender to individuals has put its first-loan default rate at around 40%. We have found no public repayment data for person-to-person loans assessed on on-chain reputation, a score built from a wallet's public history and third-party identity checks.

The 40% figure comes from Financial Times reporting relayed by Cointelegraph on 27 July 2025: Divine Research had issued about 30,000 loans under $1,000 since the previous December to borrowers verified as unique people.

DL News reported in September 2023 that Maple's deposits had fallen from close to $1 billion in May 2022 to $21 million in March 2023, by DefiLlama's count, and that every pool Maple had launched that year was over-collateralized.

Until public default data exists for person-to-person loans backed by reputation, we assume high default rates: an on-chain lender has no credit bureau, collections process or court behind the loan as a matter of course.

What does smart-contract escrow protect you from, and what does it not?

A correctly built smart-contract escrow, a contract that holds a lender's offer until the borrower accepts it or it is refunded, protects a lender before the loan starts: the platform cannot spend the funds, the borrower cannot touch them before accepting the offer, and an offer that is never accepted is refundable. After acceptance, escrow cannot make the borrower repay, because a contract can only move funds it holds, and it then holds none of the borrower's.

Such escrow is what makes peer-to-peer lending non-custodial: no company holds the funds. Repayments pass back through the contract, but only when the borrower sends them. Escrow does not cover a bug in the contract itself, whoever can upgrade or pause it, the stablecoin the loan is denominated in, or the borrower's willingness to repay.

What happens if the borrower defaults and there is no collateral?

If a borrower defaults on a loan with no collateral, the lender loses whatever principal is unpaid unless someone recovers it off-chain, through negotiation or a court. On-chain, the automatic consequence is a permanent public record of the default, which returns no money to the lender but stays attached to the borrower's wallet for later lenders and reputation scores to read.

The public reports of two 2022 defaults show recovery attempts, not completed recoveries: after the trading firm Orthogonal Trading defaulted on Maple Finance that December, the pool manager said it was considering legal action, and the lending protocol TrueFi had restructured the South Korean firm Blockwater's loan and collected about $645,000 before declaring default that October. Both borrowers were named companies. A lender to a pseudonymous wallet cannot count on the same routes, and recourse varies by jurisdiction, so we assume zero recovery when we work out a break-even default rate. The borrower's side is covered in what happens if you don't repay a crypto loan.

What should you check before you fund a loan request?

Before you fund a loan request, check ten things in three groups: the structure (where funds sit, who can change the contract, how an unaccepted offer comes back), the borrower (wallet history, past repayment, identity, fit of the amount, whether you know them) and the price (the rate, and the stablecoin over the term). If one of them cannot be verified, we treat that as a reason to pass.

Read an on-chain reputation score as a probability adjustment, not a promise, and check when it was last refreshed. In permissionless lending, where no institution decides who may borrow, the risk decision moves to each lender, and these checks are one way a lender can make it.

Which kind of crypto lending is safest?

No kind of crypto lending is safest on every count. An over-collateralized pool holds collateral against every loan and normally lets lenders leave at once, a custodial account adds ease and fiat access but can make you the company's unsecured creditor, and a loan to a person without full collateral has no early exit and can lose the whole amount lent, which the rate has to cover.

We build isolated crowd loans backed by on-chain reputation at Unlloo, so we have an interest in that last category. An isolated peer-to-peer loan wins on choosing your counterparty and avoiding shared losses, loses on liquidity and concentration, and, for loans to individuals, has no public repayment record that we could find.

No structure removes the risk of lending. Each one moves it somewhere, and the yield is what you are paid for standing there.

Sources

1. FDIC, "Fact Sheet: What the Public Needs to Know About FDIC Deposit Insurance and Crypto Companies", 28 July 2022. US deposit insurance does not cover crypto assets or the failure of non-bank crypto companies.
2. The Block, "Crypto lending protocol Wildcat says Kinto default poses 'no risk of contagion' for outstanding loans", 8 September 2025. Wildcat's first default, the loss limited to one facility and the 76% of principal its lenders were set to recover.
3. TechCrunch, "Crypto lender Celsius pauses withdrawals, transfers citing 'extreme market conditions'", 12 June 2022. Date of the Celsius withdrawal pause.
4. Fortune, "Crypto lender Celsius files for bankruptcy a month after freezing customer withdrawals", 13 July 2022. The Celsius Chapter 11 filing.
5. The Block, "Euler hacker returns $31 million, marking end to 'recoverable funds' in DeFi exploit", 4 April 2023. Size and date of the Euler exploit and the amount returned.
6. The Block, "Llama and Gauntlet submit proposal to cover $1.6 million in bad debt on Aave", 23 November 2022. Aave's bad debt after the short position in CRV, and the proposal to cover it.
7. Kiln status page, "Paused deposits for Aave Vaults as a precaution following rsETH / Kelp hack", 20 April to 12 May 2026. Stablecoin reserves at about 100% utilization for four days as of 23 April, the withdrawal warning and the 4 May report that liquidity had returned.
8. The Block, "USDC remains at about $0.90 following Circle's disclosure of funds at SVB", 11 March 2023. The USDC low reported that day and the reserves held at Silicon Valley Bank.
9. Federal Reserve Board, FEDS Notes, "In the Shadow of Bank Runs: Lessons from the Silicon Valley Bank Failure and Its Impact on Stablecoins", 17 December 2025. USDC's price fully recovered on 13 March 2023.
10. The Block, "Orthogonal Trading defaults on $36 million of loans on Maple Finance", 5 December 2022. Size of the default, share of active loans, pool losses and the pool manager's statement that it was considering legal action.
11. Bracewell LLP, "My Crypto's Gone: Cryptocurrency in Earn Accounts Belong to Celsius Not Customers", 9 January 2023. The 4 January 2023 ruling on Celsius Earn accounts, their value shortly before the July 2022 filing and the account holders' unsecured claims.
12. Galaxy Research, "KelpDAO/LayerZero Exploit Drains $290m, Freezes DeFi Markets", 22 April 2026. Users selling other assets for stablecoins and withdrawing them until the USDT and USDC pools reached 100% utilization.
13. The Block, "Kelp DAO's rsETH bridge apparently exploited for roughly $292 million in LayerZero-based attack", 18 April 2026. Date and size of the rsETH bridge exploit.
14. LlamaRisk on the Aave governance forum, "rsETH Incident Report (April 20, 2026)", 20 April 2026. rsETH deposited on Aave, WETH borrowed, bad-debt scenarios, reserves at full utilization and the size of Umbrella's WETH module.
15. CoinDesk, "Aave restores ether borrowing limits after $230 million exploit", 18 May 2026. Share of unbacked rsETH recovered and the expected role of DeFi United.
16. Cointelegraph, "Kelp DAO says rsETH restored 5 weeks after $293M protocol hack", 26 May 2026. Kelp DAO's statement that the operational part of the rsETH recovery plan was closed.
17. CryptoSlate, "Aave DAO activates on-chain slashing mechanism with 'Umbrella' launch", 6 June 2025. The launch of Umbrella to replace Aave's Safety Module.
18. Aave Labs on the Aave governance forum, "[Direct-to-AIP] Pause stkwaWETH Umbrella Staked Token on Ethereum V3", 20 April 2026. The proposal to pause Umbrella's WETH module on Ethereum, described as a temporary hold while the shortfall was assessed.
19. Finematics, "Aave: The Road To $3 Billion", 20 January 2021. ETHLend's peer-to-peer model and the move to pooled liquidity.
20. Cointelegraph, "Divine Research issues unbacked crypto loans using Sam Altman's World ID", 27 July 2025. Relays Financial Times reporting: about 30,000 loans under $1,000 issued since the previous December to borrowers verified with World ID, and a first-loan default rate of around 40% stated by the founder.
21. The Block, "South Korean firm Blockwater defaults on $3 million loan from TrueFi", 10 October 2022. The Blockwater default, the earlier restructuring and the repayments collected.
22. DL News, "Why Maple is ditching under-collateralised lending: 'No one's profitable'", 25 September 2023. Maple's deposits in 2022 and 2023 and its move to over-collateralized pools.