What DeFi is and who holds the money when no company does

What is DeFi in plain terms?

DeFi is a set of financial services that run as programs on a blockchain. You deposit tokens into a program, and the program pays interest, lends against them or swaps them for other tokens, with no bank or broker in the middle. ethereum.org's description of DeFi puts it as "You hold your money" against traditional finance, where "Your money is held by companies."

That sentence is true of the wallet and only half true of the protocol. Your tokens sit in a wallet you control until you deposit them. After the deposit they sit inside the program's own address, and the program decides what happens to them according to its rules.

A smart contract is that program. It is code that runs the same way every time it is called, and it can move tokens without anyone approving each step. A savings account works differently: a bank employee or a bank system acts on your instruction.

Who holds the money when no company does?

The contract holds it, and a small set of people hold the keys that can change the contract. "No company" describes who runs the day-to-day business, while the key holders decide whether the rules change, and that second group is where the risk sits.

Mechanism 1: the contract is the custodian

A custodian is whoever has the power to move assets that belong to someone else. In a bank that power sits with the bank. In DeFi it sits with the contract's code. When you deposit ₹5 lakh worth of tokens into a lending pool, the pool's address holds them alongside every other depositor's tokens.

Your claim on the pool is usually a receipt token, a second token the pool gives you to prove your share. If the pool is emptied, the receipt token stays in your wallet and points at nothing.

Mechanism 2: someone can usually change the code

Many protocols are built so their code can be swapped for a newer version. The usual design is a proxy contract, which keeps one fixed address while the logic behind it changes. Halborn's account of the DeltaPrime hack explains that the proxy's address "can stay the same after an upgrade." Only the contract behind it changes.

The upgrade power belongs to an admin key, a private key held by the team or a group of signers. Depositors rely on that key staying in careful hands, and nothing on the screen says whose hands those are. A private key is the secret that authorizes actions from an address. What a private key is and why losing control of one matters covers it.

Mechanism 3: a hack can be a key theft

A hack does not always mean a flaw in the code. In the DeltaPrime case, Halborn reports that an attacker with the private key of the project's ProxyAdmin made a malicious upgrade of its proxy contract. The upgraded contract "has all of the same access and privileges as the original contract," so the attacker drained the value deposited in it.

Halborn counts five malicious proxy contracts and about $6 million taken in total, later swapped to ETH. A code audit would not have caught this, because the code was working as written. The failure was in who could rewrite it.

Two protections exist: a timelock that delays any upgrade so depositors can leave first, and an upgrade that needs several signers. Each project chooses whether to use them, and a reader can check whether it has.

Mechanism 4: what you can recover

With a bank, a failed institution has a process and a regulator. With a protocol drained by a key theft, the recovery route is whatever the team decides to offer, and it may be nothing. This follows from the design: with no company holding the money, there is no company obliged to return it.

What does that look like on a ₹5 lakh position?

Take ₹5 lakh placed in one lending pool, as an illustration and not a forecast. If a drain takes the pool, the loss on that position is the whole ₹5 lakh, because every depositor's tokens sit in the same address.

Now size the position as part of a portfolio. A portfolio of ₹1 crore with 3 percent in DeFi puts ₹3 lakh in play (₹1 crore times 0.03). The same drain costs ₹3 lakh, which is 3 percent of the portfolio, and the other ₹97 lakh is untouched.

The mechanics of the loss are identical in both cases. Position size is the one thing the investor sets. It also works against a key theft, a code flaw or a protocol that stops paying. That is why a DeFi position is sized as a sleeve, a defined slice of the whole, and never as the core of a portfolio.

Before putting money in, a reader can run four checks. Who holds the admin key, and is it one person or several? Is there a delay between an upgrade being announced and taking effect? Has the code been reviewed by someone outside the team? Can the team pause or move deposits at will?

If the answer to the last question is yes, the contract is a custodian with a human behind it, whatever the front page says.

How does India tax DeFi?

India taxes gains on virtual digital assets at 30 percent under section 115BBH. A transfer carries 1 percent TDS under section 194S, and losses get no set-off or carry forward. With 4 percent cess the effective rate is 31.2 percent (30 plus 1.2). Both rules are covered in section 115BBH and 1 percent TDS under section 194S.

On a ₹50,000 gain from selling a token, the 30 percent comes to ₹15,000 (₹50,000 times 0.30). On a ₹5 lakh transfer, the 1 percent TDS is ₹5,000 (₹5 lakh times 0.01).

What the law does not spell out is each DeFi activity: providing liquidity, earning a reward, receiving a receipt token. KoinX's guide to DeFi tax in India says no official circular addresses a liquidity pool deposit. It adds that the common reading treats the deposit as a taxable exchange. It also says losses from hacks and exploits are not deductible under section 115BBH. Each position's facts decide how those points apply. A short reference sits in how DeFi yield is taxed in India.

Record-keeping is the practical consequence. Every deposit, reward and withdrawal on a protocol is a line to log with its rupee value on the day.

How does an index held in custody differ?

A Qatobit index is a basket of assets that Qatobit designs and rebalances monthly on a published methodology. The assets are held in institutional custody, and live Proof of Reserves is available at any time. You hold the basket, not the coins, so there is no admin key for the investor to vet and no pool address to watch.

In DeFi the investor does the custody diligence and carries the key risk. In an index the investor makes one decision, the thesis that fits the horizon, and the custody and reporting sit with the platform. Reading a reserves record is its own skill, and how to read a Proof of Reserves record walks through it.

An investor who wants this kind of exposure can invest in QSI Growth or start a Bitcoin SIP, and the custody question is answered before the first rupee goes in.

Where this leaves a DeFi position

DeFi is a real way to hold and use tokens without a company in between. The cost of removing the company is that the investor takes on the custody questions the company used to answer. The first question to ask a protocol is who holds the key.

A related question is how custody works when the platform does hold the assets, and what a Proof of Reserves record proves.

Frequently asked questions

What is DeFi in one sentence?

DeFi, or decentralized finance, is lending, borrowing and swapping run by smart contracts on a blockchain instead of by a bank or broker. The contract holds deposited tokens and follows its code, which is why the people who control that code matter.

Who holds my money in DeFi?

The smart contract holds it, at an address the protocol controls. A small group of admin key holders can usually change the contract's code, so they hold the real power over the deposits.

Can a DeFi protocol be hacked without a bug in its code?

Yes. In the September 2024 DeltaPrime case, Halborn reports that an attacker held the private key of the project's ProxyAdmin. The attacker upgraded the contract to a malicious one and drained about $6 million.

How is DeFi taxed in India?

Gains on virtual digital assets are taxed at 30 percent under section 115BBH, with 1 percent TDS under section 194S on a transfer and no set-off of losses. The treatment of individual DeFi activities such as liquidity deposits is not set out in a specific official circular.

How large should a DeFi position be?

That is a decision for each investor's own portfolio, but the arithmetic is simple. At 3 percent of a ₹1 crore portfolio, a total loss on the position costs ₹3 lakh, or 3 percent of the whole.

Crypto investments are subject to market risk. Not financial advice.