Fluid:
a genuinely novel architecture, and a marketing claim we found doesn't hold up anymore.
We tore apart Fluid, the lending-and-DEX protocol built by Instadapp on a single shared Liquidity Layer, across the same lending-adapted scorecard we've used throughout this series. From a genuinely distinctive architecture, Smart Collateral and Smart Debt let deposited collateral and outstanding debt simultaneously serve as DEX liquidity, extensive audits from Spearbit, Trail of Bits, and Certora, and a real, remarkable achievement: Fluid's own DEX component became Ethereum's third-largest by volume within months of its October 2024 launch, to a claim we want to correct directly. Several reviews we found repeat a "zero losses in 7 years" claim about Fluid and its Instadapp predecessor. Our own research found this is no longer accurate: a May 31, 2026 private-key compromise cost roughly $215,000; Fluid's shared liquidity layer absorbed roughly $8.2 million in bad debt from a separate protocol's exploit, handled through a team multisig that acted before governance had approved the matching treasury repayment, drawing real, disclosed on-chain criticism; and a June 2, 2026 backend hack of the Merkle reward system cost roughly 163,706 FLUID and 49,526 GHO tokens, though core contracts and user funds were confirmed unaffected and Fluid committed to covering all losses; and landed on a score the marketing page won't show you.
Our take, up front: Fluid is a lending-and-DEX protocol built by Instadapp, a DeFi infrastructure team with a genuinely long history dating to 2019, on a novel shared "Liquidity Layer" architecture. Real, genuinely distinctive design: Smart Collateral and Smart Debt let a user's deposited collateral or outstanding debt simultaneously function as DEX liquidity, earning trading fees alongside lending yield or reducing debt, a structural innovation few other protocols in this series attempt. Real, disclosed extensive audits (Spearbit, Trail of Bits, Certora formal verification on core invariants) and an active Immunefi bug bounty. Real, genuinely remarkable, disclosed achievement: Fluid's own DEX component, launched October 2024, became Ethereum's third-largest DEX by trading volume within months, behind only Uniswap and Curve. Real, disclosed genuinely distinctive UX advantages: liquidation penalties as low as 0.1% and liquidation gas costs 3-4 times lower than most competitors. What we want to correct directly: several reviews we found, including a detailed one specifically scoring Fluid's security 8.5/10, repeat a claim that Fluid and its Instadapp predecessor have gone 7 years with zero security losses. Our own research found this is no longer accurate. On May 31, 2026, a private-key compromise cost Fluid Lending roughly $215,000, classified as an infrastructure incident by DeFiLlama's own hack tracker. Separately, Fluid's shared Liquidity Layer absorbed roughly $8.2 million in bad debt originating from a different protocol's exploit (Resolv's USR), and the cleanup involved a team multisig pulling funds from the shared layer before governance had actually approved the matching treasury repayment, posting the vote only after the on-chain action was already done, which drew real, disclosed on-chain community criticism. Then on June 2, 2026, a backend hack of Fluid's Merkle reward-distribution system, exploiting a remote-code-execution vulnerability in an internally-modified library, cost roughly 163,706 FLUID and 49,526 GHO tokens; Fluid confirmed core contracts and user funds were unaffected and committed to covering all user losses. We weighted all of it below.
Real, extensive audits (Spearbit, Trail of Bits, Certora formal verification) and an active Immunefi bug bounty. Real, no confirmed direct exploit of the core Vault/Lending/DEX smart-contract logic found in our research. What we found that corrects a widely-repeated marketing claim: on May 31, 2026, a private-key compromise cost Fluid Lending ~$215,000, classified as an infrastructure incident by DeFiLlama's own hack tracker. Separately, Fluid's shared Liquidity Layer absorbed ~$8.2M in bad debt from a different protocol's exploit (Resolv's USR), handled via a team multisig acting before governance had approved the matching treasury repayment. On June 2, 2026, a backend hack of the Merkle reward-distribution system cost ~163,706 FLUID and 49,526 GHO tokens; core contracts and user funds were confirmed unaffected, and Fluid committed to covering all user losses.
Pros
- No confirmed direct exploit of the core Vault/Lending/DEX smart-contract logic found in our research
- June 2026 backend hack: core contracts and user funds unaffected; full loss coverage committed
- Extensive, named audits plus an active bug bounty program
Cons
- May 2026: $215K private-key-compromise infrastructure incident, per DeFiLlama's own hack tracker
- May 2026: $8.2M in bad debt absorbed from a separate protocol's exploit via the shared Liquidity Layer
- June 2026: backend Merkle-system hack (~163,706 FLUID + 49,526 GHO stolen)
- A widely-repeated "zero losses in 7 years" claim no longer holds as of our research
Real, disclosed substantial TVL, roughly $1.6-1.7 billion across Ethereum, Arbitrum, Base, and Polygon per one detailed source, with roughly 4x year-over-year growth. We found a real, notable discrepancy with a separate source citing $735 million; we're disclosing this range rather than picking whichever figure is larger.
Pros
- Roughly 4x year-over-year TVL growth per a detailed source
- Substantial multi-chain deposits across four networks
Cons
- Our sources disagree meaningfully on the exact current TVL figure
Real, disclosed functioning FLUID governance token with specific, disclosed proposal thresholds (1% of supply to submit, 4% for quorum). What tempers this: a real, disclosed May 2026 governance-process failure. A team multisig pulled roughly $8 million from the shared Liquidity Layer to cover third-party-linked bad debt before governance had actually approved the matching treasury repayment, posting the vote only after the on-chain action was already complete, which drew real, disclosed on-chain community criticism.
Pros
- Disclosed, specific governance proposal and quorum thresholds
- The protocol did remain solvent and no user deposit was touched during the Resolv-linked cleanup
Cons
- A team multisig acted before governance approved the matching treasury repayment, drawing direct community criticism
Real, disclosed multi-chain support (Ethereum, Arbitrum, Base, Polygon) and genuinely broad collateral support. Real, genuinely distinctive Smart Collateral/Smart Debt architecture enabling collateral and debt to simultaneously serve as DEX liquidity, a structural capability most competitors in this series don't offer.
Pros
- Smart Collateral/Smart Debt let deposits and debt double as DEX liquidity
- Broad, multi-chain asset support
Cons
- The shared Liquidity Layer design also means cross-protocol contagion risk, as the Resolv-linked bad debt showed
Real, disclosed genuinely distinctive UX advantages: liquidation penalties as low as 0.1%, and liquidation gas costs 3-4 times lower than most competitors. Real, honestly disclosed complexity concern from a detailed source: understanding Smart Collateral and Smart Debt "requires DeFi literacy beyond the average user."
Pros
- Liquidation penalties as low as 0.1%; liquidation gas 3-4x lower than most competitors
Cons
- Smart Collateral/Smart Debt require real DeFi literacy beyond casual users, per a detailed source
Real, disclosed genuinely competitive capital efficiency: collateral can earn both lending yield and DEX swap fees simultaneously. Real, disclosed pre-configured Fluid Vaults offering sophisticated, disclosed strategies (leveraged staking, delta-neutral stablecoin yield).
Pros
- Collateral can earn lending yield and DEX fees simultaneously
- Pre-configured, disclosed leveraged and delta-neutral vault strategies
Cons
- FLUID token doesn't yet have revenue sharing, per a detailed source
Real, genuinely distinctive, sophisticated feature set: Smart Collateral, Smart Debt, pre-configured leveraged and delta-neutral Vaults, and Fluid DEX, which became Ethereum's third-largest DEX by volume within months of its October 2024 launch.
Pros
- Fluid DEX reached #3 by Ethereum DEX volume within months of launch
- Genuinely novel Smart Collateral/Smart Debt architecture and pre-configured Vault strategies
Cons
- Newer, more architecturally complex than single-purpose competitors, per a detailed source
Access only through Fluid's official app, and don't rely on "zero losses" claims you find elsewhere.
Given that several general reviews still repeat an outdated "zero losses in 7 years" claim, verify current incident history directly against DeFiLlama's hack tracker or Fluid's own security page before relying on any single source's framing, and understand that the shared Liquidity Layer means a different protocol's exploit can become your problem too.
A genuinely brilliant architecture, and a track record that's more current, and more complicated, than its own marketing suggests.
We want to be clear that Fluid's core engineering is real and impressive: unifying lending and DEX liquidity into one capital-efficient layer is a genuinely novel idea, and the fact that its DEX component out-competed most standalone DEXs within months is a real, substantive achievement, not a marketing talking point. That's why we didn't score this low. But we also think a "zero losses in 7 years" claim, still repeated by reviews published as recently as February 2026, deserves to be checked against what's actually happened since, and what we found is a materially different picture: three separate 2026 incidents, an infrastructure key compromise, a third-party contagion event handled with a real governance-process shortcut, and a backend hack the team responded to responsibly. None of these touched the core lending or DEX logic, and that distinction matters. But a shared liquidity layer is, by design, a shared risk surface, and the Resolv-linked bad debt is a real, concrete demonstration of exactly that trade-off. We think Fluid earns real credit for its engineering and its responsible handling of the backend incident, and real scrutiny for a marketing claim that hasn't kept pace with its own year.
The scorecard above is deliberately general. Whether Fluid is right for you depends heavily on which of these you already are.
The DeFi power user who wants genuine capital efficiency, collateral earning both lending yield and DEX fees at once
This is exactly where Fluid's genuinely distinctive Smart Collateral/Smart Debt architecture delivers real, demonstrated value.
The user who wants access to pre-configured leveraged or delta-neutral vault strategies without building them manually
Fluid's disclosed Vault products offer genuinely sophisticated strategies in a simplified, packaged form.
The user who checks current incident history directly rather than relying on outdated "zero losses" claims found elsewhere
Given what we found in our own research, this specific habit genuinely matters here more than the marketing suggests.
Newer users who'd rather not evaluate genuine architectural complexity before depositing
Aave and Compound, both reviewed earlier in this series, offer a simpler, single-purpose model for that specific preference.
The scorecard covers the headline judgment calls. These four tables cover the specifics we didn't want to bury in prose; three 2026 incidents laid out precisely, the Resolv-linked governance timeline, how Smart Collateral/Smart Debt actually work, and our thirteenth lending-protocol comparison entry.
Three 2026 incidents, precisely
| Date | What happened | Amount | Core contracts affected? |
|---|---|---|---|
| May 31, 2026 | Private-key compromise, classified as an infrastructure incident by DeFiLlama | ~$215,000 | No |
| ~May 2026 | Shared Liquidity Layer absorbs bad debt from a separate protocol's exploit (Resolv's USR) | ~$8.2 million | No, third-party-linked |
| Jun 2, 2026 | Backend hack of the Merkle reward-distribution system via a remote-code-execution vulnerability | ~163,706 FLUID + 49,526 GHO | No; core contracts and user funds confirmed unaffected |
In every case, the core Vault, Lending, and DEX smart-contract logic itself was not the point of failure; but three real, distinct incidents within roughly one month is not consistent with a "zero losses" claim, regardless of which specific layer each one touched.
The Resolv-linked cleanup, timelined
| Step | What happened |
|---|---|
| 1. The exploit | A separate protocol, Resolv, suffers an exploit affecting its USR asset |
| 2. The exposure | Fluid's shared Liquidity Layer holds exposure to the resulting bad debt through a permissioned credit line |
| 3. The cleanup | A team multisig pulls ~$8M in USDC/USDT from the shared layer via a pre-approved credit line to make depositors whole |
| 4. The governance question | The matching $8.2M treasury repayment requires a governance vote to unlock; that vote was posted to the forum only after the on-chain action was already complete |
The protocol stayed solvent and no user deposit was touched, which matters and deserves credit; but "the vote happened after the action" is a real, disclosed sequencing problem for a system that relies on governance approval as a genuine check.
How Smart Collateral and Smart Debt work
| What it does | |
|---|---|
| Smart Collateral | Deposited collateral simultaneously acts as DEX liquidity, earning trading fees alongside lending yield |
| Smart Debt | Outstanding debt simultaneously acts as DEX liquidity, with swap fees helping offset the borrow cost |
| Shared Liquidity Layer | The base layer every Fluid subprotocol (Lending, Vault, DEX, DEX Lite) draws from, rather than each maintaining separate pools |
This shared design is precisely what makes the capital-efficiency gains possible, and precisely what let a different protocol's exploit become a real, disclosed liability for Fluid's own depositors.
Lending protocols, side by side (series continues)
| Aave | Compound | Kamino | Morpho | SparkLend | Euler | Jupiter Lend | Maple | Venus | Fluid | |
|---|---|---|---|---|---|---|---|---|---|---|
| Most severe disclosed history | $292M bridge exploit | $161.7M governance bug | None found | $18M vault loss | None found | $197-240M exploit, recovered | None on contracts | ~$50-54M in 2022 defaults | Known vuln., exploited twice | 3 incidents (~$8.4M combined), core contracts unaffected |
| Distinctive model | Multi-network V3/V4 | Isolated Comet markets | Curator-managed markets | Immutable core + vaults | Aave fork, blue-chip only | Modular EVK/EVC vaults | Smart Collateral/Debt, superapp | Institutional credit | Compound fork | Shared layer, lending+DEX unified |
Fluid and Jupiter Lend both use "Smart Collateral/Smart Debt" branding for related but distinct mechanisms; we're treating this as a naming similarity worth noting rather than evidence either copied the other.
We don't just want to hand you our number; we want to show you how it sits next to what other review desks and comparison sites have published. We're including one source's numeric security score (dexrank.com, 8.5/10) directly, while flagging that its "zero losses in 7 years" framing is now outdated based on our own more recent research.
Our score lands meaningfully below the aggregated industry average; most reviews we found, including a detailed one scoring Fluid's security 8.5/10, were published before or without accounting for the three 2026 incidents our own research surfaced.
| Source | Score | Type |
|---|
Scores compiled by our editorial team from publicly available reviews as of August 2026. "Editorial estimate" means the outlet didn't publish a single numeric score, so we converted their published verdict and sentiment into a comparable 100-point figure. Verify current figures directly with each source before citing them elsewhere.
The core Vault, Lending, and DEX smart-contract logic has no confirmed direct exploit in our research. However, three separate 2026 incidents occurred: a $215,000 private-key compromise (May 31), $8.2 million in bad debt absorbed from a different protocol's exploit (May 2026), and a backend hack of the Merkle reward system (June 2, ~163,706 FLUID + 49,526 GHO stolen, core contracts unaffected).
This claim, repeated by several reviews including ones published as recently as February 2026, no longer holds as of our research. Three distinct incidents occurred in 2026 alone, though none touched the core lending or DEX smart-contract logic directly.
Features that let deposited collateral or outstanding debt simultaneously function as DEX liquidity, earning trading fees alongside lending yield or offsetting borrow costs, a structural innovation built on Fluid's shared Liquidity Layer.
A separate protocol, Resolv, suffered an exploit affecting its USR asset. Fluid's shared Liquidity Layer held exposure to the resulting bad debt (~$8.2M) through a permissioned credit line. A team multisig pulled funds to cover it, but the matching governance vote to unlock the treasury repayment was posted only after that action was already complete.
No. Fluid confirmed core contracts and user funds were unaffected; the attack targeted the Merkle reward-distribution system specifically, and Fluid committed to covering all resulting user losses.
Our sources disagree, ranging from roughly $735 million to $1.6-1.7 billion depending on the source and date; we're disclosing this range rather than picking the more flattering figure.
Fluid DEX became Ethereum's third-largest DEX by trading volume within months of its October 2024 launch, behind only Uniswap and Curve, a genuinely remarkable achievement for a component built on top of a lending protocol's liquidity layer.
Instadapp, a DeFi infrastructure team operating since 2019, previously known for DeFi Smart Wallets and DeFi Smart Accounts. The INST token was rebranded to FLUID in December 2024.
More Reviews
Ledn – Crypto Lending & Borrowing Review
Score: 75/100. Highest CeFi score in this series: 10 straight PoR attestations, explicit no-re-lending pledge, never lost customer funds.
Read More
Aave – Crypto Lending & Borrowing Review
Score: 69.5/100. Category leader hit hardest by the Apr 2026 KelpDAO crisis: $124-230M bad debt, its largest liquidity event yet.
Read More
Compound – Crypto Lending & Borrowing Review
Score: 63.25/100. Pioneer whose 2021 self-inflicted $161.7M COMP bug remains its scar, though its caution spared it in Apr 2026.
Read More
CoinRabbit – Crypto Lending & Borrowing Review
Score: 50.5/100. Fast, no-KYC lending with a great product, but no named founder, no PoR, and vague licensing behind it.
Read More