What is the fair interest rate for DeFi? Don't deposit if it's below this number!

Original Author: Tom Dunleavy, Venture Capital Lead at Varys Capital

Compiled by Odaily Planet Daily (@OdailyChina);

Translator: Azuma (@azuma_eth)

A week ago, KelpDAO's rsETH bridge protocol based on LayerZero suffered a hacker attack, resulting in a loss of $292 million. Subsequently, these stolen rsETH were deposited into Aave as collateral, leaving a bad debt of approximately $196 million on Aave's books, ultimately causing the total TVL of the entire DeFi market to evaporate by $13 billion.

Two weeks prior, the derivatives protocol Drift Protocol on Solana also lost $285 million due to a key leak incident caused by a social engineering attack from North Korean hackers.

These two incidents within three weeks resulted in a permanent loss of $577 million. The utilization rate of the USDC market on Aave remained above 99.87% for four consecutive days, while the deposit rate surged to 12.4%. Circle Chief Economist Gordon Liao subsequently proposed a governance proposal to quadruple the borrowing limit, merely to alleviate the queue situation.

For users accustomed to depositing stablecoins in DeFi lending markets at rates of 4% - 6%, a crucial question now arises — Are these yields still reasonable? A few weeks before the Kelp DAO incident, Santiago R Santos raised this question on the Blockworks podcast, and it warrants in-depth exploration: Were we ever adequately compensated for the DeFi risks we took, and what should a reasonable spread be in the future?

How Traditional Finance Prices Credit Risk

The yield of every corporate bond is a sum of multiple compensations. The most critical formula in this analysis is — Yield = Risk-Free Rate + (Probability of Default × Loss Given Default) + Risk Premium + Liquidity Premium.

The risk-free rate (Rf) is benchmarked against U.S. Treasuries of matching maturity; "Probability of Default × Loss Given Default" (PD × LGD) represents the expected loss, where LGD is calculated as "1 - Recovery Rate"; the risk premium compensates for the uncertainty of expected losses — even if two bonds have the same PD and LGD, their pricing will differ if the distribution of outcomes is wider; the liquidity premium compensates for exit costs.

Moody's long-term data since 1920 provides a benchmark:

• U.S. Speculative-Grade Corporate Default Rate: Long-term annual average of 4.5%, currently 3.2% over the past 12 months, expected to rise to 4.1% by Q1 2026;
• Unsecured High-Yield Bond Recovery Rate: Historically around 40%, corresponding to an LGD of ≈ 60%;
• High-Yield Bond Expected Loss: 4.5% × 60% = 2.7%/year (long-term average);
• Private Credit Default Rate: KBRA estimates 3.0% for 2026;
• Private Credit Recovery Rate: Approximately 48% (KBRA 2023-2024 data); 
• Secured Leveraged Loan Recovery Rate: Historically about 65%–75%;

Current Traditional Finance Yield Ladder

Let's look at the current actual data. The 10-year U.S. Treasury yield is 4.29%. As of April 2026, the spreads for various ICE BofA credit assets are as follows.

The overall pattern is intuitive: from government bonds to investment grade, and then to speculative grade and subordinated commercial real estate, yields gradually increase as one moves down the capital structure to compensate for default probability and loss severity. Direct lending yields are around 9%, not because default rates are significantly higher, but because the liquidity premium for holding illiquid private assets is very real.

Now look at Aave's USDC rate before the Kelp DAO incident, around 5.5%, sitting between investment grade and B-rated high yield; while Morpho (with manager selection through curated vaults) yields around 10.4%. These two numbers cannot simultaneously accurately reflect the same underlying risk.

DeFi Has "Defaults" That Don't Exist in Traditional Finance

Traditional credit default is relatively straightforward: a borrower defaults, and the creditor can accelerate debt maturity, proceed with restructuring and asset disposition. DeFi has no restructuring mechanism, only exploits, with three main modes of failure.

Mode 1: Smart Contract Vulnerabilities

Code flaws (reentrancy attacks, input validation errors, lack of access controls, etc.) allow attackers to drain funds. Historical recovery rate: approximately 5%–15% if returned by white hats; nearly 0% if by North Korean hackers.

The Poly Network (2021) attacker returning the full $611 million was an extreme outlier. Losses from Ronin ($625 million) and Wormhole ($325 million) were covered by project teams/institutions, essentially shareholder bailouts, not recoveries.

Mode 2: Oracle Manipulation and Governance Attacks

Manipulating low-liquidity DEX pools to pollute price sources, or exploiting governance attacks to drain funds via malicious proposals. Beanstalk lost $182 million this way in 2022. Such events are partially reversible, but claims often become demands on "valueless tokens."

Mode 3: Composability Contagion

This was KelpDAO's failure mode, and it's the most dangerous because it's the hardest to audit.

• Protocol A issues LST/restaking tokens;
• Protocol B accepts them as collateral;
• Protocol C handles cross-chain bridging;

If any link fails, all downstream assets become "orphaned." The attacker didn't need to attack Aave, just rsETH.

The commonality across all three modes is that once a problem occurs, the collapse happens in minutes, not quarters. There is no negotiation, no restructuring, no buffer. Code is law, and code failure means near-total loss. Aave V3's rsETH bad debt went from 0 to $196 million in about 4 hours. In contrast, the median time from showing signs of stress to restructuring for a traditional BB-rated default is 14 months.

What Do the Loss Data Reveal?

Chainalysis noted an interesting phenomenon in its 2025 report: despite DeFi's TVL growing from $40 billion in early 2024 to approximately $175 billion by October 2025, specific DeFi attack losses were close to the 2023 lows. The $3.4 billion in crypto theft in 2025 mainly came from CEXs (Bybit alone accounted for $1.5 billion) and personal wallets (44%, up from just 7% in 2022).

If you only look at this chart, you might conclude that DeFi is becoming safer. This is partially correct. Smart contract audits have matured; bug bounty programs like Immunefi now protect over $100 billion in user funds; cross-chain bridge architectures are gradually incorporating time locks and multi-party verification.

But the actual situation in 2026 tells a different story. On April 1, Drift lost $285 million; on April 18, KelpDAO lost $292 million. Two nine-figure events in 18 days, both targeting weaknesses in composability rather than core lending primitives. Based on average TVL, the annualized loss rate for DeFi in recent years is roughly as follows.

• 2024: ~$500 million DeFi-specific losses / $75 billion average TVL = 0.67% annualized loss rate;
• 2025: ~$600 million / $120 billion average TVL = 0.50% annualized loss rate;
• 2026 YTD (annualized): If extrapolating Q2 losses for the full year, ~$577 million / $95 billion TVL * 4 = approximately 2.0% to 2.5%;

If we set the forward-looking annualized probability of default (PD) for high-quality DeFi lending at 1.5% to 2.0%, and the Loss Given Default (LGD) at 90% (average recovery rate of 5% to 15% for direct exploit attacks without external balance sheet backing), then the expected loss is 1.35% to 1.80% per year.

This level is already higher than high-yield bonds (HY), and this doesn't yet account for the additional premiums for uncertainty, illiquidity, regulatory asymmetry, and the structural contagion risk inherent in composability.

Building a DeFi Risk Premium from Scratch

From this point, we will apply a bond pricing methodology to attempt to price the fair yield for a high-quality DeFi stablecoin deposit — specifically, overcollateralized lending in USDC to retail and quantitative borrowers on Ethereum mainnet via Aave or Compound.

As shown in the chart above, we start from the 10-year U.S. Treasury benchmark and build the fair yield upwards. The framework is based on the Duffie-Singleton credit spread decomposition, adapted for DeFi-specific failure modes.

The components of this pricing model are as follows:

• Risk-Free Rate (10Y U.S. Treasury): +4.30%;
• Technical Expected Loss (PD × LGD): +1.50%;
• Oracle Manipulation Risk: +0.75%;
• Governance / Admin Key Risk: +1.00%;
• Composability Cascade Risk (like Kelp DAO): +1.25%;
• Regulatory Asymmetry Risk: +1.25%;
• Stablecoin Depeg Tail Risk: +0.50%;
• Liquidity Premium: +0.50%;
• Risk Premium (Model Uncertainty): +1.50%;

The final derived fair yield is at least 12.55%.

Therefore, for high-quality DeFi stablecoin supply on top-tier protocols, a reasonable interest rate should be no less than 13%. For positions with explicit insurance coverage (such as Nexus Mutual coverage or Umbrella-type protocol reserves), it can be lower; for long-tail protocols, newly deployed markets, or exposures involving restaking and cross-chain structures, it should be higher.

Conclusion

Ultimately, our conclusions are as follows.

First, demand reasonable compensation. If you are lending USDC in DeFi at 5%, you are essentially pricing a risk technically and composably inferior to CCC-grade at BB-grade credit levels. The 9% to 12% offered by curated vault markets like Morpho is closer to a fair clearing price, although it introduces its own manager selection and transparency issues.

Second, move up the capital structure. Overcollateralized lending based on high-quality collateral (ETH, wBTC, market-proven LSTs), with oracle redundancy, protocol-level insurance layers, and no cross-chain exposure, carries a significantly lower risk premium than the framework above. If directly accessible, this is the DeFi equivalent of "investment-grade assets."

Third, correctly price tail risk. The KelpDAO attack was not a black swan, but a predictable failure mode within multi-chain, restaking structures. The Drift incident was fundamentally the same, just with different actors. Q2 2026 has already generated $577 million in permanent losses. A DeFi portfolio yielding 5.5% has a catastrophic drawdown risk that this yield is completely unable to cover.

DeFi is not uninvestable, but it is mispriced at the top of the book. Institutional-grade opportunities do exist, but only for capital allocators who either meet the risk premium within this framework or underwrite specific protocols individually, like treating them as private credit. The so-called "lazy trade" — depositing stablecoins into a top-tier money market and accepting its advertised yield — is essentially a carry trade masquerading as a risk-free rate.