Top DeFi Exchanges: Custody, Control and Security Compared
Last Updated: September 15, 2026
The top DeFi exchanges on September 15, 2026 differ most in who controls funds and rules. Uniswap ($3.62 billion TVL) and Curve ($1.28 billion) keep liquidity in token-governed pools, Hyperliquid ($14.18 billion open interest) runs its own validator chain, and EVEDEX matches orders off-chain and settles them on Arbitrum L2.
"Trading without intermediaries" is the promise every DeFi exchange makes, but the details vary a lot. On some venues your tokens never leave your wallet except during a swap. On others you bridge assets to a separate chain, post margin into an exchange contract or depend on price oracles and a small group of validators. Each design moves risk somewhere rather than removing it: to smart contracts, to oracles and validators, or to you, since no venue can restore a wallet if you fail to secure your seed phrase. This comparison looks at eight leading venues through three questions: where your funds sit, who can change the rules, and what the record shows, with at least two documented drawbacks for each. For the same venues ranked by what a trade costs, see our guide to the best DeFi exchanges.
Top DeFi Exchanges Compared by Custody and Control
The first row, EVEDEX, splits the work between an off-chain order book and settlement on Arbitrum L2; read how the EVEDEX perp DEX works for the details.
| Exchange | Where funds sit | Who can change the rules | Record and size | Drawbacks |
|---|---|---|---|---|
| EVEDEX | USDT margin in the exchange's settlement contracts on Arbitrum L2; orders matched off-chain | Off-chain matching engine operated by the exchange; CertiK completed 2 smart contract audits, the latest on July 28, 2025 | $678.6M open interest; $500,000 ADL Protection Reserve since July 18, 2026 | No spot trading, only 52 pairs, P2P and Copy Trading not launched |
| Uniswap | Your wallet until the swap; liquidity providers' tokens sit in pool contracts | UNI holders vote on protocol fees; the UNIfication proposal activated them in December 2025 | $3.62B TVL and $74.4B 30-day volume across v2, v3 and v4 | Anyone can list a scam token, and mainnet gas makes small swaps expensive |
| Curve | Your wallet until the swap; LP funds in stableswap pool contracts, mostly on Ethereum | veCRV holders vote in the Curve DAO, which directs CRV emissions to pool gauges | $1.28B TVL, $1.22B of it on Ethereum; $3.55B 30-day volume | Designed for pegged pairs, and liquidity is concentrated on one network with high gas |
| Aerodrome | Your wallet until the swap; LP funds in pools on Base | veAERO voters decide which pools receive AERO emissions | $322.1M TVL and $13.98B 30-day volume, half of all DEX volume on Base | Runs on a single network, and pool depth shifts when voters redirect emissions |
| Hyperliquid | Bridged to Hyperliquid L1; its bridge held $6.60B on September 15, 2026 | Validators of its own chain, who voted to delist the JELLY market in March 2025 | $14.18B open interest across 404 perpetual pairs, the largest perpetual DEX | Funds depend on one bridge, and validators have shown they can intervene in a market |
| GMX | Collateral in GMX contracts; LP funds in GM pools on Arbitrum and Avalanche | GMX DAO; position prices come from oracles rather than an order book | $203.3M V2 TVL; a V1 exploit took about $40M in July 2025, fully recovered, V2 unaffected | Oracle dependence adds a point of failure, and borrow fees build up on open positions |
| dYdX | Bridged to dYdX Chain, a Cosmos SDK application blockchain | DYDX token governance; 25% of net protocol fees fund DYDX buybacks since March 2025 | $44.3M open interest across 119 perpetual pairs | Much less open interest than Hyperliquid, and funds must move to a separate chain |
| CoW Swap | Your wallet until a solver settles the signed order on-chain | CoW DAO governance; independent solvers compete to fill each batch | $3.34B routed over 30 days on Ethereum, Base, Arbitrum and other networks | Fills wait for a batch auction, and execution quality depends on active solvers |
Data as of September 15, 2026. TVL, bridge balance and 30-day volume: DefiLlama. Open interest: CoinGecko. Governance and incidents: Uniswap fees documentation, Curve 3pool contract, GMX incident update, dYdX on CoinGecko, CoW Protocol. EVEDEX audits: CertiK Skynet.
Where Your Funds Sit on a DeFi Exchange
The phrase "non-custodial" covers four different arrangements, and each carries its own risk.
Wallet until the trade. On Uniswap, Curve, Aerodrome and CoW Swap, tokens stay in your wallet until you sign. The swap takes them from your address, runs them through a pool or a solver's settlement and returns the other token in the same transaction. The main risks are what you sign: a malicious approval, a fake token or a phishing copy of the site. Smart contracts themselves can also fail, which is why audits and a long track record matter.
Liquidity in pools. If you provide liquidity, your tokens live in a pool contract for as long as the position stays open. A bug in that contract, or in a compiler or library it depends on, can put them at risk even if you never trade.
Bridged to another chain. Hyperliquid and dYdX run their own blockchains, so assets must cross a bridge first. That bridge becomes a large pool of value, $6.60 billion in Hyperliquid's case, and its security depends on the validators or signers who control it.
Margin in an exchange contract. Perpetual venues such as GMX and EVEDEX hold your collateral in trading contracts while positions are open. The contract settles profits, losses, funding and liquidations. Here the extra risks are liquidation and the rules for handling losses that exceed a trader's margin.
Six Trust Questions to Ask Before Trading
A DeFi exchange removes one intermediary and introduces others: developers, voters, validators, oracles and solvers. These questions show which ones matter for a given venue.
- Where exactly are my funds between trades? In your wallet, in a pool, behind a bridge or in a margin contract. Each answer points to a different failure mode.
- Who can upgrade or pause the contracts? Look for timelocks, multisig signers and governance processes in the documentation. A venue that can pause trading can protect users in an incident, and can also stop you from exiting.
- Where do prices come from? Pools set their own prices, order books rely on market makers, and oracle-based venues trust external feeds. Oracle failures and thin books both show up as bad fills in volatile minutes.
- What do the audits cover? An audit reviews specific contracts at a specific time. Check the scope and date instead of treating a logo as a guarantee.
- What happened in past incidents? How a team responded, whether funds were recovered and whether users were compensated says more than a promise of security.
- How are extreme losses handled? Perpetual venues need a plan for positions that lose more than their margin, such as insurance or reserve funds and auto-deleveraging rules.
Wallet hygiene applies everywhere: keep your recovery phrase offline, as our guide on how to secure your seed phrase explains, and revoke approvals you no longer need.
What Past Incidents Teach
Two recent events show how risk moves around in DeFi. On July 9, 2025, an attacker used a re-entrancy flaw in GMX V1 to take about $40 million from its GLP pool on Arbitrum. GMX said a week later that the funds had been fully recovered and secured in its treasury, that a $5 million bounty had been paid, and that GMX V2 was never affected. The lesson is that older contract versions stay live and exposed long after a newer version launches.
In March 2025, Hyperliquid's validators voted to delist the JELLY market after a squeeze. The vote contained the damage, but it also showed that an order-book chain run by a limited validator set can step into a market when it decides to. Neither event is unique to these venues. Both are reminders that "decentralized" describes an architecture, not an absence of people who can act.
EVEDEX: Security Facts and Limits
EVEDEX is a hybrid exchange for perpetual futures. Orders are matched off-chain on an order book, and balances and settlement run on-chain on Arbitrum L2, with margin posted in USDT. CertiK has completed two audits of EVEDEX smart contracts, the latest delivered on July 28, 2025 with no critical findings, and its CertiK Skynet Score was 94.36 on September 11, 2026. These audits cover the smart contracts, not every part of the exchange. Since July 18, 2026, a $500,000 ADL Protection Reserve has been in place to reduce cases where profitable positions are closed by auto-deleveraging.
There is no traditional KYC; deposits pass automated AML screening, and some external fiat partners may still ask for verification. Fees are 0.015% maker and 0.045% taker, and leverage reaches 200x on BTC-USD, ETH-USD and SOL-USD for positions up to $50,000 notional. The limits are clear: no spot market, 52 perpetual pairs, cross margin only, and P2P and Copy Trading are still on a waitlist. To see how matching and settlement are split, read how the EVEDEX perp DEX works. Perpetual futures carry a high risk of loss.
