Crypto earn risks, ranked by how often they actually bite

There is a predictable shape to writing about crypto earn risks. Slashing gets a section because it has a violent name. Smart contract exploits get one because they produce headlines with large numbers in them. Price risk gets a sentence at the end, usually phrased as a disclaimer. That ordering is exactly backwards. If you sort the ways people have actually lost money in yield products by frequency and by aggregate size, the list starts with the asset falling and ends with slashing — and slashing barely registers.

This page ranks the risks in that realised order, attaches evidence to each one, and finishes with a checklist you can work through before depositing anything. The historical case studies live on a separate page: four CeFi lenders failed between June 2022 and January 2023, and the most important thing about their resolution is that creditors were repaid in dollars fixed at 2022 prices rather than in coins. That story is told in full inthe CeFi lending collapses.

The ranking, and why it is in this order

Frequency is a better organising principle than severity because most readers are not deciding whether to accept a tail risk. They are deciding whether to move a balance from one product to another. The question that actually helps them is not "what is the worst thing that could happen" but "what usually happens". The table below answers that. Every entry is drawn from an event with a date and a number attached.

Price risk swamps the reward, and the arithmetic is not close

A staking yield is a percentage of a quantity of tokens. Your wealth is that quantity multiplied by a price. Reward rates on the largest assets move within a band of a few percentage points a year; prices move that much in an afternoon. Ethereum's network reward rate was 2.46% on16 September 2026, against net issuance of 0.88%. Set that against the price path: above $4,900 at the 2025 high, around $1,700 in June 2026. Nothing on the yield side of the ledger changes the sign of that outcome.

This is not an argument against earning. It is an argument for sizing the decision correctly. Choosing between a 3% product and a 5% product is a second-order question if you have not first decided how much of the asset to hold at all. Readers working through that allocation question will find building a crypto income allocation more useful than another rate comparison. And on stablecoins, where price risk is largely absent by design, the risks in this list reorder themselves entirely — stablecoin yield covers that case separately.

Counterparty risk: what happens when the company fails

The second-most-common way to lose money is for the entity holding your assets to stop being able to return them. Between June 2022 and January 2023, four significant lenders failed in sequence. Celsius froze withdrawals on 12 June 2022 and filed for Chapter 11 on 13 July 2022. Voyager collapsed in July 2022 after Three Arrows Capital defaulted, with customers locked out for over a month and, according to the Federal Trade Commission, more than $1 billion of customer crypto lost. BlockFi filed in November 2022 on FTX and Alameda exposure. Genesis halted withdrawals in November 2022 and filed in January 2023, taking Gemini Earn with it.

The mechanism in every case was the same: customer deposits were an unsecured claim on a balance sheet, and that balance sheet was carrying credit risk the customer could not see. This is why the disclosure question matters more than the rate question. Ledn states that its stablecoin yield comes from an overcollateralised bitcoin-backed retail loan book and holds the accounts in separate Cayman SPVs. Xapo Bank states that its US dollar savings yield comes from AAA-rated US Treasury bills and money market funds. Bitpanda states in plain language that its stablecoin product is an unsecured loan to Bitpanda GmbH, that ownership of the assets passes to Bitpanda for the term, and that the product is unregulated. Nexo and Crypto.com do not disclose their yield source on consumer pages at all, and CEX.IO does not explain how its Savings rates are generated. Those are findings, not accusations — but an undisclosed yield source is the single feature the 2022 failures had in common.

Smart contract risk, and the 2026 exploit patterns

Code risk is real, well documented and — unusually for this list — improving in aggregate size while worsening in frequency. Three attack patterns recur through 2026 and are worth recognising by name, because they tell you which product types are exposed.

• Donation attacks and share-accounting errors. An attacker manipulates the ratio between a vault's deposits and its share supply, usually when the vault is nearly empty, so that later depositors receive fewer shares than they paid for. Tectonic lost $124.47 million this way on 30 August 2026. Notional V2 lost $1.73 million to a token and share accounting error on 4 September 2026.
• Unbacked cross-chain mints. A bridge or wrapper is tricked into issuing tokens on one chain without the corresponding assets being locked on the other. Liquid Network lost $320 million on 6 September 2026, the largest single incident of the year to that date, and Nomic lost $3.15 million on 9 September 2026. This is the same failure class as Wormhole in February 2022 and the BNB Beacon bridge in October 2022.
• Compiler and reentrancy faults in mature code. The Curve incident of 30 July 2023 cost $61.7 million and originated in a Vyper compiler bug, not in the pool logic. Age and audit history reduce this risk; they do not remove it.

Two further exposures sit inside the smart contract category and are routinely missed. The first is oracle risk: on 10 October 2025 Binance's internal marks drove Ethena's USDe to $0.65 on that venue while the token held its value everywhere else, which liquidated positions that were never actually undercollateralised. The second is curator risk in vault-based lending. On Morpho and Euler, a curator sets each vault's allocations, caps and fees, so a depositor is trusting a risk model as much as a codebase — and two vaults with the same name can charge 5% and 25% performance fees respectively. Neither exposure is visible from an advertised APY.

Lock-up and illiquidity: the risk that converts into a loss

Illiquidity is rarely a loss on its own. It becomes one when it stops you acting during the window in which acting mattered. Three separate layers create it. The protocol layer: Polkadot unbonds in 28 days, Cosmos in 21, Tron in 14, and Avalanche hard-locks a delegation for between 14 days and a year with no early exit at all, while Cardano and Algorand impose nothing. Ethereum runs a queue rather than a fixed period — on 16 September 2026 the entry queue stood at about 31 days and 19 hours while the exit queue was effectively empty at roughly 26 minutes, and both figures have moved by a factor of three during 2026.

The product layer sits on top. Binance's locked Simple Earn products forfeit all accrued rewards on early redemption, and its ETH staking redemptions run through a daily quota system during which rewards stop accruing. Crypto.com returns your principal minus every reward already paid if you exit a fixed term early, and its CRO fixed terms cannot be exited early at all. KuCoin's own documentation states that where early redemption is permitted, "the amount returned could be lower than the original principal". Kraken's flexible staking has no unbonding but stakes only up to 50% of the balance you commit. These terms are disclosed; they are simply not in the headline number. Rates and their conditions sets them out side by side.

The October 2025 liquidation event as a stress test

If you want a single episode against which to test any leveraged or oracle-dependent product, use 10 and 11 October 2025. Roughly $19 billion was liquidated across about 1.6 million accounts, nine times larger than any previous single-day event. Around 70% of the total — $6.93 billion — happened in the forty minutes between 20:50 and 21:30 UTC, a rate of $10.39 billion per hour, with $3.21 billion liquidated in the single sixty-second window at 21:15 UTC. Bitcoin fell 14.5%, from $122,574 to $104,782. Ether fell 12.2%. Solana briefly dropped more than 40%. Around $350 billion of market capitalisation was erased.

What makes it a useful test is not the size but the mechanism. Nothing became insolvent. The losses came from liquidation cascades, venue-specific pricing and thin order books at the exact moment depth was needed. Any product whose yield depends on funding rates, on leverage, or on an oracle reading a single venue would have been tested that night. Products that are simply passing through protocol rewards were not.

Why slashing is last

Slashing is the penalty a proof-of-stake network applies for equivocation — proposing two blocks at the same height, or signing two conflicting attestations. Downtime is not slashable; it is merely unrewarded. Since the Beacon Chain launched in December 2020, fewer than 500 validators have been slashed out of more than 1.2 million active, and the Pectra upgrade cut the initial penalty to 1/4096 of effective balance. Most proof-of-stake chains covered in this research — Cardano, Avalanche, NEAR, Tron, Sui, Aptos, Algorand and Polygon — have no slashing mechanism at all.

The honest caveat is the correlation penalty. Ethereum applies a second charge at roughly the 18-day mark, scaled to how much stake was slashed in the surrounding window. For an isolated incident it rounds to nothing. In a mass correlated event it can approach the entire balance. That is a genuine tail risk for a concentrated operator, and it is a reason to care which operator you delegate to. It is not a reason for a retail delegator to rank slashing above the price of the asset. The mechanics are covered in more depth incrypto staking explained and, for a single network, inEthereum staking.

The diligence checklist

Work through these in order. The first three eliminate most products in under ten minutes, which is the point.

Regulatory and tax risk, briefly

Two risks sit outside the product and are easy to leave out of a comparison. The first is regulatory: in the United States every current permission for staking rests on agency interpretation rather than statute, after the Senate cloture vote on the CLARITY Act failed 49–50 on 15 September 2026. In the European Union, MiCA prohibits remuneration linked to how long a holder holds an e-money or asset-referenced token, which is why compliant platforms withdrew stablecoin rewards for EU customers. Both positions are described without prediction inthe regulation of crypto yield, and their practical effect on who can access what is mapped inavailability by country.

The second is tax timing. In several jurisdictions a reward is taxable when you receive it, not when you sell it, which means a locked or illiquid reward can still create a cash liability. That interaction between lock-up risk and tax timing is the one place where two items on this list compound each other, and it is explained in tax on crypto earnings. Neither page is advice.