A recent Galaxy report highlighted that despite Tether leading the crypto lending market with two other companies, decentralized applications posted nearly double the amount in outstanding loans at the end of 2024.

According to the report, the crypto lending market stood at roughly $30 billion on Dec. 31, excluding collateralized debt position (CDP) stablecoins. 

This exclusion provides a clearer view of the crypto lending market. The report noted that some overlap may exist between the total size of centralized finance (CeFi) loan books and the supply of CDP stablecoins. 

The reason is that specific CeFi lenders use crypto collateral to mint CDP stablecoins, which are then lent to off-chain borrowers, creating the potential for double-counting. 

Adding CDP stablecoins enlarges the market size to $36.5 billion. Tether, Galaxy, and Ledn comprised 88.6% of the CeFi lending sector, with a combined loan book of $9.9 billion. This group represented 27% of the total crypto lending market, including CDP stablecoins.

The $36.5 billion market size is down 43% from its $64.4 billion peak in the last quarter of 2021. The market contraction is attributed to the collapse of multiple lenders and a broader decline in borrower demand.

CeFi for institutions

CeFi lending consists of three major categories: over-the-counter (OTC) lending, prime brokerage services, and on-chain private credit. 

These offerings target institutional borrowers with customized terms and collateral structures, often executed off-chain or via hybrid mechanisms.

OTC loans remain common among accredited investors due to their bilateral customization capabilities, including adjustable loan-to-value ratios and maturity terms. 

Prime brokers offer margin financing tied to a narrower set of digital assets and exchange-traded products. At the same time, on-chain private credit allows users to deploy capital using off-chain credit agreements via on-chain liquidity aggregation.

Although centralized services offer tailored credit products, their reach has narrowed considerably due to heightened counterparty risk and decreased retail trust following high-profile insolvencies between 2022 and 2023.

DeFi lending up 959% since 2022

Open borrows across DeFi protocols reached $19.1 billion in the fourth quarter, spread over 20 lending applications and 12 blockchain networks. 

This represents a 959% increase from the last quarter of 2022, when the DeFi market reached a low of $1.8 billion in open borrows. The report attributes the surge to the resilience of permissionless platforms, cross-chain capital mobility, and the emergence of specialized lending applications.

Unlike CeFi, DeFi lending enables users to engage directly with smart contracts to borrow and lend assets without intermediaries.

Protocols such as Aave, Compound, and newer cross-chain services offer real-time transparency, flexible rates, and automated liquidation mechanisms. DeFi’s modular design allows protocols to adapt to user demand, asset risk, and evolving liquidity conditions.

This growth reflects a user preference for trust-minimized infrastructure and the operational stability DeFi protocols demonstrated during volatile market conditions. 

The report concluded that centralized entities such as Tether are critical in institutional lending. However, the accelerating shift toward DeFi platforms reflects a broader realignment of capital flows and risk frameworks within the crypto economy.

Mentioned in this article

A recent cybersecurity report by Sekoia revealed an evolving threat posed by the Lazarus Group, the notorious North Korea-linked hacking group. It is now leveraging a tactic known as “ClickFix” to target job seekers in the cryptocurrency sector, particularly within centralized finance (CeFi).

This approach marks an adaptation of the group’s earlier “Contagious Interview” campaign, which was previously aimed at developers and engineers in artificial intelligence and crypto-related roles.

Lazarus Exploits Crypto Hiring

In the newly observed campaign, Lazarus has shifted its focus to non-technical professionals, such as marketing and business development personnel, by impersonating major crypto firms like Coinbase, KuCoin, Kraken, and even stablecoin issuer Tether.

The attackers build fraudulent websites mimicking job application portals and lure candidates with fake interview invitations. These sites often include realistic application forms and even requests for video introductions, fostering a sense of legitimacy.

However, when a user attempts to record a video, they are shown a fabricated error message, which typically suggests a webcam or driver malfunction. The page then prompts the user to run PowerShell commands under the guise of troubleshooting, thereby triggering the malware download.

This ClickFix method, though relatively new, is becoming more prevalent due to its psychological simplicity – since users believe they are resolving a technical issue, and not executing malicious code. According to Sekoia, the campaign draws on materials from 184 fake interview invitations, referencing at least 14 prominent companies to bolster credibility.

As such, the latest tactic demonstrates Lazarus’s growing sophistication in social engineering and its ability to exploit the professional aspirations of individuals in the competitive crypto job market. Interestingly, this shift also suggests that the group is expanding its targeting criteria by aiming not just at those with access to code or infrastructure but also at those who might handle sensitive internal data or be in a position to facilitate breaches inadvertently.

Despite the emergence of ClickFix, Sekoia reported that the original Contagious Interview campaign remains active. This parallel deployment of strategies suggests that North Korea’s state-sponsored collective may be testing their relative effectiveness or tailoring tactics to different target demographics. In both cases, the campaigns share a consistent goal – delivering info-stealing malware through trusted channels and manipulating victims into self-infection.

Lazarus Behind Bybit Hack

The Federal Bureau of Investigation (FBI) officially attributed the $1.5 billion attack on Bybit to the Lazarus Group. Hackers targeting the crypto exchange employed fake job offers to trick staff into installing tainted trading software known as “TraderTraitor.”

Although crafted to look authentic through cross-platform JavaScript and Node.js development, the applications embedded malware designed to steal private keys and execute illicit transactions on the blockchain.