1. What changes when you trade DeFi
No account, no KYC at the protocol, no withdrawal approval - and no support desk, no freeze-and-refund, no undo. Your self-custody wallet signs everything. The exchange risks of Part I don't disappear; they transform into smart-contract and user-error risk.
2. Smart-contract risk
Every DEX, pool and bridge is code holding money. Bugs are exploited continuously - bridges alone have lost billions. Audits lower probability, not possibility; a fresh unaudited token contract is a coin flip with extra steps. The DeFi principle: code executes exactly as written, including when it is wrong.
3. Rug pulls and honeypots
The DEX listing layer has no admission control: anyone lists anything. Rug pulls (developers empty liquidity) and honeypots (buyable, not sellable) are structural features, not bugs in the system - they are the reason permissionless trading needs permissionless scepticism. Practical tells: locked/verified liquidity, concentration of holdings, contract renouncement - none perfect, all necessary.
Remember: "If you can't sell it, you don't own it" - approval management (revoke old allowances) is part of DeFi hygiene, like locking doors.
4. The visible and invisible costs
Gas fees are visible; MEV is not: bots see your pending trade and extract value via front-running or sandwiching. Small trades on busy chains can pay double-digit percent in combined friction. On a CEX, you paid a spread; on-chain, the auction is public.
5. When this fails
DeFi trading fails on the same math as everything else - plus failure modes CEX traders never meet: infinite-mint bugs, oracle manipulation (thin pools reporting fantasy prices), bridge exploits, and governance capture. Insurance does not exist in most cases; "the code is the law" also means the loss is the law.
Risk: Approving a token contract can expose the whole balance of that token, forever, until revoked. The most profitable exploit in DeFi history is still the user signing what they didn't read.