Crypto investors who once turned to decentralized finance for easy passive income through juicy yields are running into a new reality: the numbers no longer add up.

DeFi, or onchain finance, is essentially conducting banking transactions on a blockchain, cutting out middlemen like banks and letting investors borrow, lend, and trade in minutes. Back in 2021-2022 (and even through the subsequent crypto winter), DeFi's returns were more than promising; rates reached 20% on protocols like Aave and thousands of percent on other emerging protocols, which would justify parking some cash for high interest rates, albeit with a higher risk of hacks, exploits and quick liquidations.

Read more: What is DeFi?

Fast forward to 2026, Aave, the largest DeFi lending protocol by total value locked, is currently offering an APY of around 2.61% on USDC deposits. That sits below the 3.14% offered on idle cash at Interactive Brokers, one of the most popular traditional platforms among crypto-native investors. The gap may not seem huge on paper, but it undermines one of DeFi's core theses: higher returns for higher risk. Instead, money sitting in DeFi is now facing a higher risk for lower returns.

"DeFi: earn 1% below T-bills and lose all your money one time per year," wrote trader James Christoph on X on March 22.

That blunt take reflects a broader shift. For years, DeFi sold itself as a place where higher returns justified new kinds of risk. Today, that trade-off looks harder to defend.

Where the yield went

It was not always this way.

In 2024, DeFi yield looked genuinely competitive. Ethena — a protocol that issues a synthetic dollar stablecoin, USDe, backed by assets and hedged through derivatives positions — saw its sUSDe product offer more than 40% APY at its peak and pulled billions in deposits. But those returns were largely a product of ENA (Ethena's native token) incentives and trading strategies that didn't last.

Ethena's APY has since compressed to around 3.5%, while its total value locked (TVL) has fallen from a peak of roughly $11 billion to $3.6 billion. Ethena didn't immediately respond to the request for a comment by press time.

Across the rest of the stablecoin lending market, yields have followed a similar path lower.

Aave's largest USDT pool yields 1.84%, while several other pools sit below 2%. The extra reward that once boosted returns have largely disappeared. What remains is organic yield driven by borrowing demand, and it is not strong enough to push yields higher.

Data from vaults.fyi shows how far things have fallen. Aave's two largest stablecoin pools — USDT and USDC on Ethereum — are yielding just over 2% on a combined $8.5 billion in deposits. Lido's stETH, the largest pool, returns 2.53%, while Ethena's staked USDe has fallen to 3.47%.

Only a handful of protocols are still beating Interactive Brokers' 3.14% rates. These are largely private credit products or strategies tied to real-world assets such as Sky's USDS Savings rate of 3.75%, which has emerged as one of the more attractive refuges in this environment, sitting above the Aave average and drawing $6.5 billion in deposits.

But the rate comes with a caveat: around 70% of Sky's income derives from offchain sources, including U.S. Treasury products, institutional credit lines, and Coinbase USDC rewards. For investors who came to DeFi specifically to avoid that kind of exposure, the distinction matters.

Aave does still offer more competitive rates on select stablecoins beyond its flagship USDC pool. Its sGHO product currently yields 5.13%, while other options of V3 Core Ethereum include USDG at 5.9%, RLUSD AT 4.4% AND USDTB AT 4.0%. But these sit outside the headline figures that most comparisons focus on.

Paul Frambot, co-founder of Morpho, a lending infrastructure protocol, says this bleak outcome for yields was inevitable.

"Undifferentiated lending converges toward risk-free rates because when every depositor shares the same collateral, the same parameters, and the same outcome, there is limited room for specialization and returns compress," he told CoinDesk.

Morpho, with over $10 billion in deposits, offers a different model. Its platform lets curators build lending vaults - essentially customized pools with their own risk parameters, collateral choices and yield strategies, managed by specialist teams rather than governed by a single set of rules. Some of these curated vault models can still generate relatively higher yields. Its Steakhouse Prime USDC and Gauntlet USDC Prime vaults are both yielding 3.64%, while one vault, Sentora's PYUSD offering, is at 6.48%.

Frambot says the difference comes down to how risk is managed. "What makes the vault and curator model different is that it externalizes risk curation and opens it up to real competition," he said. "That creates an open marketplace for yield, where returns are driven by the quality and differentiation of strategies rather than liquidity alone. That is also why bluechip stablecoin yields on Morpho are on average higher than in pooled models and backed by straightforward collateral like BTC and ETH."

Still, the yields are nowhere near what they were in previous years.

Aave frames the current weakness as cyclical rather than structural. The protocol points to unusually depressed crypto sentiment - with the Fear and Greed Index below its 2022 lows - as a key driver of reduced borrowing demand, which in turn weighs on deposit rates. “Stablecoin rates on Aave have largely tracked leverage demand,” a spokesperson told CoinDesk. “We do not see them as structurally lower going forward.”

The company also notes that its weighted-average stablecoin deposit yield over the past year has still beaten Interactive Brokers’ top offering, meaning depositors who entered before 2025 would still be ahead today.

'Really dark'

Lower yields, though, are only part of the story. Confidence across DeFi has also taken a hit.

Balancer Labs, once one of the most recognizable names in decentralized exchange infrastructure, has recently shut down after a $110 million exploit. Governance tokens across the sector are trading at low valuations. For many, it feels like energy has been drained out of the space.

Jai Bhavnani, a prominent DeFi investor, wrote on X that the space is feeling "really dark," describing the combination of yield compression, protocol shutdowns, and recent exploits as a perfect storm.

"LPs are realizing most protocols are too much risk too little reward," he wrote. "There is no catalyst on the horizon to change things."

Some in the same thread pushed back, arguing that market downturns tend to flush out the weakest projects and leave behind only those protocols that can genuinely sustain themselves. This counterpoint has historical precedent; DeFi has survived prior cycles and emerged with more resilient infrastructure. That may be true, but it offers little comfort to investors sitting on compressed returns today.

Then there is smart contract risk, or more precisely, the growing range of risks that smart contract audits cannot catch.

Last month, Resolv, a yield-bearing stablecoin protocol, was exploited for roughly $25 million. An attacker deposited 100,000 USDC into the protocol's minting contract and received 50 million USR in return, roughly 500 times the expected amount. The issue was not a flaw in the smart contract code itself. Instead, the system lacked basic safeguards such as oracle checks and minting limits.

The protocol now holds $113 million in assets against $173 million in liabilities. USR is trading at $0.13, having lost its $1.00 peg and continuing to tumble into the end of March.

The Resolv hack sits within a broader pattern. Hackers stole more than $2.47 billion worth of cryptocurrency in the first half of 2025 alone, already exceeding all of 2024, according to CertiK's Hack3d report. Wallet compromises accounted for $1.7 billion of that total. Immunefi CEO Mitchell Amador told CoinDesk earlier this year that onchain code is actually getting harder to exploit, but that attackers are adapting, pivoting to operational failures, stolen keys, and social engineering instead. For example, the more recent $270 million exploit on Drift protocol was part of a social engineering program by North Korea.

For investors weighing up a 2%-3% yield on DeFi against 3.14% at a traditional brokerage, that context is hard to ignore. The extra return that once justified the exposure has largely disappeared.

But the deposit rate comparison only tells part of the story. An Aave spokesperson said: "For borrowers and margin traders, Aave offers much more competitive rates than IBKR — currently 3.2% on Aave vs. up to 6.14% on IBKR. Borrowers on Aave also benefit because their collateral continues to earn yield, further reducing effective borrowing costs compared to IBKR."

Regulatory 'Clarity'

On top of compressed yields and persistent security risks, DeFi is now facing a regulatory threat targeting its yield model.

The Digital Asset Market Clarity Act, the crypto industry's most significant pending legislation, includes a provision that would ban passive stablecoin yield earned simply for holding a dollar-pegged token. That would mean rewards tied to activity, such as payments or transfers, would still be allowed, although the distinction remains unclear. Something that crypto industry insiders who reviewed the draft described to CoinDesk as "overly narrow and unclear."

Recently, 10x Research's Markus Thielen said that if the Clarity Act is passed, it could re-centralize yield into traditional finance and regulated products, creating a headwind for DeFi.

Bottom line: the DeFi provisions of the bill remain unresolved, with several Senate Democrats citing concerns about illicit finance. But the direction of travel on yield is clear enough: at a moment when DeFi returns are already struggling to justify the risk, Washington is potentially moving to narrow the options further.

That leaves DeFi in a tight spot. Yields are down. Risks remain. And new rules could limit what returns are left.

For now, the math that once drew investors in is looking much less convincing.

Read more: How North Korea's 6-month-long secret espionage program has crypto community rethinking security