DeFi and bridge risk basics

The risks you take when using DeFi protocols and cross-chain bridges for airdrop farming, from contract bugs to oracle failures, and how to size your exposure.

Last reviewed 2026-10-27 · 2 min read

On this page
  1. The main risks
  2. How to size your exposure
  3. When something goes wrong

Airdrop farming often means depositing into new protocols before they have a token, a long track record or much scrutiny. That is exactly when risk is highest. Even fully legitimate projects can lose user funds.

The main risks

Smart contract bugs. Code that does not behave as intended can let an attacker drain deposits. Audits reduce this risk but do not remove it. Exploits of audited protocols happen regularly.

Bridge risk. Cross-chain bridges hold large pools of assets and have been among the most heavily exploited parts of crypto. Well-known examples include the Ronin bridge (2022, around 600 million dollars), Wormhole (2022, around 320 million dollars) and Nomad (2022, around 190 million dollars). When a bridge is exploited, the tokens it issued on the other chain can lose their backing.

Admin key risk. Many protocols can be upgraded or paused by a team multisig. If those keys are compromised, or the team acts maliciously, deposits are at risk.

Oracle and economic attacks. Protocols that depend on price feeds can be manipulated, sometimes with flash loans, to drain lending pools or mint excess tokens.

Depegs and liquidations. Staked, wrapped and restaked tokens and stablecoins can lose their peg. Leveraged positions can be liquidated in fast markets.

Frontend hijacks. Even when the contracts are safe, the website can be compromised, for example through a DNS hijack or a compromised code dependency, and serve a drainer on the real domain. Read the wallet popup even on sites you trust.

How to size your exposure

  • Only deposit what you can afford to lose in any single new protocol.
  • Spread across protocols rather than putting everything in one.
  • Prefer simpler positions. Each extra layer (wrapping, restaking, looping, leverage) adds another way to lose.
  • Check the basics: how long the protocol has been live, how much value it holds, whether the code is public and audited, and who controls upgrades.
  • Withdraw from protocols you no longer use, and revoke their approvals. See token approvals.

When something goes wrong

If a protocol you use announces an exploit:

  • Follow only the project's official channels. Scammers immediately post fake "refund" and "migration" links.
  • Withdraw only if the team confirms it is safe to do so, and revoke approvals to the affected contracts.
  • Do not sign anything on "rescue" sites offered in replies or DMs.