CeFi Lending Explained: How $17.78B in Loans Work and Why Systemic Risks Still Exist

CeFi lending has staged a surprising recovery to $17.78 billion in active loans three years after catastrophic platform failures wiped out billions in user funds and shattered confidence in centralized crypto credit markets. The resurgence appears substantial on surface metrics, yet the structural vulnerabilities that triggered 2022’s collapse—rehypothecation, opacity, and concentration risk—remain largely unaddressed beneath a veneer of regulatory compliance and measured growth.

The fundamental question facing the sector hasn’t changed since Celsius, BlockFi, and Voyager imploded: when users deposit crypto with centralized lenders, how much genuine control and security do they actually retain?

The Recovery That Wasn’t Quite What It Seemed

Galaxy Research data from Q2 2025 reveals combined crypto lending reached $44.25 billion excluding collateralized debt positions, or $53.09 billion including them—approaching the all-time highs established during 2021’s peak euphoria. However, the composition of this recovery tells a more nuanced story than aggregate numbers suggest.
DeFi protocols captured approximately 60% of the market with $26.47 billion in active loans, posting impressive 42% quarter-over-quarter growth. Aave exemplifies this dominance, surpassing $3 trillion in cumulative deposits by August 2025 with over $29 billion in active loans and total value locked exceeding $40 billion.
The DeFi surge stems directly from transparency advantages that became painfully relevant after 2022’s CeFi implosions. On-chain visibility allows users to verify collateral ratios, monitor liquidation risks, and audit protocol mechanics without trusting opaque corporate assurances. When trust evaporated from centralized platforms, users migrated to infrastructure where they could verify rather than believe.
CeFi’s recovery trajectory followed a different arc—smaller, slower, and concentrated among fewer survivors. The sector grew 14.66% quarter-over-quarter to reach $17.78 billion, representing careful reconstruction rather than explosive rebound. Only a handful of firms survived the 2022 shakeout, and those that did refocused operations around compliance frameworks, risk monitoring, and brand rehabilitation.

Yet this measured recovery masks unresolved structural issues. The same rehypothecation practices that amplified 2022’s collapse remain widespread, platforms continue operating with minimal transparency about loan books and collateral deployment, and market concentration has intensified rather than diversified.

Oligopoly Dynamics Create Correlated Vulnerabilities

The current CeFi lending landscape is dominated by three entities controlling between 74% and 89% of the entire market: Tether commands 57.02% share with $10.14 billion in outstanding loans, Nexo holds 11% with $1.96 billion, and Galaxy Digital accounts for 6.23% at approximately $1.11 billion.
Market concentration at these levels produces a Herfindahl-Hirschman Index between 3,450 and 3,500—formally qualifying the sector as an oligopoly under antitrust frameworks. This consolidation carries direct implications for systemic stability, competitive dynamics, and user options.
When three players control nearly 90% of a market, their risk profiles become highly correlated. If one major lender experiences liquidity stress, the contagion mechanism that paralyzed the entire sector in 2022 could repeat with even less cushion for absorption. The 2022 crisis had multiple mid-sized players who could theoretically absorb some shock; today’s landscape offers no such buffer.
Oligopoly conditions also suppress competitive pressure that would normally drive innovation and transparency improvements. Dominant players face minimal incentive to overhaul profitable existing systems or increase disclosure that might reveal uncomfortable operational realities. Smaller competitors lack the scale and capital reserves to challenge incumbents meaningfully.
This concentration creates pricing power that allows major lenders to influence deposit rates and lending terms unilaterally. Users seeking significant liquidity have virtually no alternatives—they must accept terms from the same three providers or exit CeFi entirely. The resulting lack of competitive discipline removes market forces that would normally constrain excessive risk-taking.

The Celsius Lessons That Remain Unlearned

Celsius Network’s June 2022 collapse provides the clearest cautionary tale about CeFi vulnerabilities, yet many structural parallels persist today. When Celsius failed, it managed approximately $20 billion across 1.7 million customer accounts, built on a foundation that proved catastrophically unstable.
The failure stemmed from straightforward operational flaws: aggressive rehypothecation of customer deposits, reckless yield-chasing through illiquid investments, and zero liquidity preparation for withdrawal demands. Celsius lent customer funds into long-duration projects while guaranteeing instant withdrawals—a maturity mismatch that works perfectly until it doesn’t.
When market conditions deteriorated, Celsius couldn’t meet redemption requests because customer assets were locked in illiquid positions. The platform froze withdrawals, filed bankruptcy, and left users fighting over whatever remained in an insolvency proceeding that continues dragging through courts.
What’s troubling about the current CeFi landscape is how many of these same vulnerabilities remain embedded in operations. Major platforms including Nexo, Salt Lending, Strike, and Ledn explicitly state in terms of service that they may redeploy customer collateral for their own purposes. This rehypothecation creates the identical maturity mismatch and leverage amplification that destroyed Celsius.
Industry rhetoric has shifted—platforms now emphasize “prudent risk management” and “regulatory compliance”—but the fundamental business model hasn’t materially changed. Rehypothecation is simply disclosed in fine print rather than hidden entirely, a legal rather than structural modification.
The concentration dynamic makes potential failures more rather than less dangerous than 2022. When multiple mid-sized platforms collapsed then, the shock distributed across several entities. Today, if Tether’s lending operations or Nexo faced similar stress, the impact would concentrate instantly because alternatives barely exist.

Why Institutions Still Choose Opacity Over Transparency

Despite obvious risks, institutional capital continues flowing to CeFi rather than DeFi for operational rather than ideological reasons. Corporate treasuries, hedge funds, and traditional finance entities understand centralized counterparties because they mirror conventional banking relationships.
CeFi provides several characteristics that institutions prioritize over transparency. Regulatory clarity comes embedded through KYC and AML compliance integrated into every transaction, satisfying legal departments and auditors. Qualified custodians like BitGo and Zodia/Fireblocks offer asset safeguarding under licensed frameworks that institutional risk committees recognize and approve.
Flexible loan structuring allows customized terms that DeFi’s rigid smart contracts cannot yet accommodate. Complex collateral arrangements, bespoke maturity schedules, and negotiated covenants require human negotiation that automated protocols don’t support. Execution speed matters enormously when deploying large capital—instant settlement across significant volumes beats waiting for block confirmations.
From an operational perspective, CeFi feels familiar. It behaves like traditional finance with crypto assets substituted for conventional instruments, only faster and yield-generating. Institutional staff already understand counterparty risk management, credit analysis, and relationship banking—the same frameworks apply to CeFi with minor modifications.
However, this operational comfort can prove dangerously misleading. The same opacity that drove retail users toward DeFi after 2022 still characterizes institutional CeFi relationships. Corporate treasurers accepting CeFi loan terms often cannot verify actual collateral deployment, loan book composition, or cross-exposure to other counterparties any better than retail users could at Celsius.
Institutions assume their scale provides negotiating leverage for better risk disclosure, yet evidence suggests even large counterparties receive limited visibility into actual platform operations. When failures occur, institutional status provides no protection—Celsius, BlockFi, and Voyager all had substantial institutional client bases who lost funds alongside retail users.

The Rehypothecation Problem That Won’t Disappear

Rehypothecation—reusing customer collateral for the platform’s own trading or lending activities—remains CeFi’s original sin and most persistent vulnerability. The practice transforms user deposits from segregated assets into leverage multipliers that amplify both returns during good times and losses during stress.
When platforms rehypothecate, they create chains of obligations where the same underlying collateral supports multiple positions simultaneously. Customer A deposits Bitcoin as collateral for a loan. The platform lends that Bitcoin to Customer B. Customer B uses it as collateral elsewhere. Each link in the chain assumes the collateral is available, but actual assets exist only once.
This structure works smoothly when markets rise or remain stable—everyone’s collateral maintains sufficient value, margin calls don’t trigger, and obligations get met. When markets decline sharply, the chain breaks. Liquidations cascade through the system as each party tries recovering collateral that’s already been deployed elsewhere.
The 2022 crisis demonstrated this mechanism with brutal clarity. Platforms couldn’t meet withdrawal requests because customer assets were locked in chains of rehypothecation that couldn’t unwind fast enough. The liquidity crunch became self-reinforcing as each platform’s stress triggered withdrawals from others, accelerating the collapse.

Notably, a small subset of CeFi platforms have adopted policies explicitly rejecting rehypothecation. CoinRabbit, for instance, maintains strict segregation of client funds and refuses to deploy customer collateral for any purpose beyond securing individual loans. This approach sacrifices yield optimization but eliminates the systemic vulnerability that rehypothecation creates.
Irene Afanaseva, CMO at CoinRabbit, frames this as foundational rather than optional:

“CoinRabbit’s top priority is user security. We clearly understand that the absence of rehypothecation is vital for the entire market, which is why we openly state that we do not use client funds. We believe that as the market grows, more CeFi platforms will follow this simple rule – user assets must remain secure.”

However, platforms avoiding rehypothecation remain exceptions rather than the rule. The majority of CeFi lenders view collateral redeployment as essential for generating yields that attract deposits and maintain profitability. Until market forces or regulation require segregation as standard practice, the vulnerability persists.

Speed and User Experience Define New Competitive Terrain

Beyond security concerns, operational efficiency increasingly separates CeFi platforms as user expectations evolve. DeFi protocols like Aave and Compound issue loans within seconds through automated smart contract execution. Traditional CeFi platforms lag substantially, with average processing times between 24-48 hours due to manual KYC verification and internal risk reviews.
This speed differential matters enormously in volatile crypto markets where hours can separate profitable opportunities from losses. Users with time-sensitive needs—traders capturing arbitrage, businesses meeting payroll, individuals facing margin calls elsewhere—cannot afford multi-day processing delays.
Some CeFi platforms have prioritized speed improvements as competitive differentiation. CoinRabbit claims loan issuance around ten minutes, providing near-instant liquidity while maintaining verification processes. Strike has similarly optimized processing flows, though most competitors remain constrained by legacy operational frameworks.
The efficiency gap highlights CeFi’s fundamental tension: manual processes that enable flexibility and regulatory compliance inherently create delays that automated DeFi protocols avoid. Platforms must choose between speed advantages that attract users and control mechanisms that satisfy compliance requirements—an optimization problem with no perfect solution.
User experience extends beyond just speed to encompass communication, interface design, and support responsiveness. Platforms offering proactive liquidation warnings, multi-channel alerts, and dedicated account management create stickiness that transcends pure rate competition. CoinRabbit’s approach of direct outreach when positions approach risk thresholds exemplifies this service-oriented differentiation.

The Transparency Crisis That Defines CeFi’s Ceiling

Opacity remains CeFi’s defining weakness and most significant competitive disadvantage versus DeFi alternatives. Few centralized platforms disclose meaningful information about loan-to-value ratios across portfolios, liquidation logic and thresholds, collateral composition, or fee structures beyond basic rate cards.
BlockFi’s collapse illustrated how opacity enables platform decisions that surprise users catastrophically. The platform repeatedly changed interest rates and terms without adequate explanation, created complex investment vehicles users didn’t understand, and ultimately deployed funds into ventures like Three Arrows Capital that proved disastrous when that counterparty failed.
DeFi flipped the transparency standard completely. Every transaction, collateral movement, and protocol parameter exists on-chain where anyone can audit operations in real-time. Users don’t need to trust platform statements—they can verify actual behavior through blockchain data.
CeFi platforms, conversely, operate behind corporate walls where users must trust press releases, marketing materials, and periodic attestations from firms with financial incentives to present favorable narratives. Even audits and proof-of-reserve reports provide only snapshots at specific moments rather than continuous visibility.
This transparency gap creates vulnerability during stress periods. When markets become volatile, CeFi users cannot assess their actual risk exposure because they lack visibility into how their collateral is deployed, what other positions might trigger liquidations, or whether the platform maintains adequate reserves. Unable to verify safety, rational actors withdraw preemptively—creating the bank runs that CeFi platforms fear most.
Some users accept this opacity trade-off in exchange for other benefits CeFi provides—higher yields, flexible terms, fiat on-ramps, customer support. However, each market shock erodes tolerance for operating in the dark, slowly shifting the balance toward transparent alternatives.

When Concentration Becomes a Single Point of Failure

CeFi’s oligopoly structure doesn’t just limit competition—it transforms the entire market into a tightly coupled system where individual platform failures create immediate systemic consequences. This coupling manifests through multiple channels that weren’t as prominent when the market was more fragmented.
First, major CeFi lenders share similar business models, risk profiles, and collateral strategies. When market conditions stress one platform, the same conditions likely stress others simultaneously. Correlated risk exposures mean platforms face liquidity crunches together rather than offsetting each other’s pressures.
Second, large lenders serve as counterparties to each other and to trading firms operating across multiple platforms. Three Arrows Capital’s 2022 collapse triggered cascading failures precisely because the fund had borrowed from multiple lenders simultaneously. Today’s concentration means a single large counterparty failure would hit an even larger percentage of the market.
Third, limited competition removes pressure for innovation in risk management, transparency, or operational resilience. When users have few alternatives, platforms face minimal consequences for maintaining marginal practices—the market won’t punish them because exiting CeFi entirely is the only option.
Fourth, regulatory frameworks develop around existing major players, creating rules that entrench current market structure. Compliance costs and capital requirements become barriers protecting incumbents from new entrants who might introduce different approaches or innovations.
The concentration also creates problems for the broader crypto ecosystem. Institutions needing large-scale credit access must use the same three providers, limiting credit availability when those platforms tighten conditions. Projects seeking working capital face similar constraints. The lack of diverse credit sources makes the entire market more fragile.

What Genuine Safety Would Require

Transforming CeFi from its current state to genuinely safe infrastructure would require fundamental rather than cosmetic changes across multiple dimensions. The gap between current practices and actual safety represents not minor adjustments but fundamental business model revisions.
Eliminating rehypothecation entirely would be the foundational step. Platforms would need to maintain strict segregation of customer assets, using collateral only to secure the specific loan it’s posted against. This approach sacrifices yield optimization but removes the correlated liquidation chains that amplify market stress.
Radical transparency about loan books, collateral composition, and risk exposures would need to become standard. Platforms should publish real-time data about aggregate loan-to-value ratios, collateral types, geographic exposures, and counterparty concentrations. Users deserve visibility into actual risk profiles rather than relying on periodic attestations.
Reserve requirements ensuring platforms maintain sufficient liquid assets to meet withdrawal demands during stress would prevent Celsius-style liquidity crunches. These reserves couldn’t be collateral posted by users but rather platform capital specifically designated for meeting obligations.
Regulatory frameworks need harmonization across jurisdictions to prevent regulatory arbitrage where platforms choose locations based on laxest oversight. Coordinated standards around custody, collateral segregation, and disclosure would raise baseline safety across the industry.
Competitive diversity must increase through lowered barriers to entry for new models and approaches. The current oligopoly suppresses innovation—more players with different risk philosophies would reduce correlated exposures and provide users with genuine alternatives.
Some platforms already implement portions of this safety framework. CoinRabbit’s model of cold storage with multisig access, zero collateral reuse, and immediate withdrawal availability demonstrates that security and accessibility can coexist. However, these remain exceptions proving the rule rather than industry standards.

The Path Forward Remains Uncertain

CeFi lending’s rebound to $17.78 billion represents resilience but not necessarily safety. The market looks healthier by numerical metrics—more loans outstanding, positive growth rates, regulatory compliance language—yet underlying structural flaws remain fundamentally unaddressed.
The sector survived 2022’s crisis through consolidation and caution rather than through solving the problems that caused failures. Fewer platforms means each remaining entity carries greater systemic importance. Slower growth means vulnerabilities stay hidden during calm periods. Compliance focus addresses regulatory risk but not the operational risks that actually triggered collapses.
Whether CeFi can evolve from survival to genuine safety depends on choices platforms and users make in coming years. If platforms continue prioritizing yield optimization over security through persistent rehypothecation, another crisis becomes matter of when rather than if. If users demand transparency and segregation as baseline requirements rather than premium features, market forces might drive necessary changes.
The DeFi alternative continues gaining market share precisely because it resolved the transparency problem through architecture rather than promises. CeFi’s competitive response cannot simply be “trust us more this time”—it must be fundamental operational changes that make trust unnecessary through verifiable safety.
For now, the question hanging over $17.78 billion in CeFi lending remains the same one that preceded 2022’s collapse: when users deposit crypto with centralized platforms, how much control do they actually retain? Until that question receives satisfactory answers through transparent operations and structural safeguards, CeFi’s recovery remains incomplete regardless of numerical growth.
The industry has proven it can survive. Whether it deserves to thrive depends on what comes next.