Is Instadapp safe? What the risk actually looks like
Instadapp does not custody your funds, but that does not mean it is risk-free. Here is what actually determines whether using it is safe for you.
How Instadapp's architecture affects safety
Instadapp is non-custodial: the DSA smart account that holds your position is deployed under your own address, and Instadapp's front end never takes possession of your assets. This removes one entire category of risk — the exchange-style hack where a company loses customer deposits — but it introduces a different one. Because a DSA is a contract, its safety depends on the correctness of that contract's code, not on trusting a company's balance sheet.
The practical consequence is that Instadapp's safety is really the safety of several stacked systems: the DSA implementation itself, the underlying lending protocols it connects to (Aave, Compound, MakerDAO, Morpho), the price oracles those protocols rely on, and the Instadapp Lite or Fluid contracts if you use those products. A failure in any layer can affect you even if the layer you interacted with directly is sound.
What Instadapp has done to reduce smart contract risk
Instadapp's core contracts have gone through external security reviews over the project's history, and the code for the DSA layer, Lite vaults and Fluid is publicly available on GitHub for anyone to inspect. Public availability does not equal safety, but it does mean the code is not a black box, and independent researchers have looked at it over the years.
That said, no amount of review eliminates risk entirely. Audits check code against a scope and a point in time; they do not certify that a protocol is bug-free forever, and they do not cover every possible interaction between Instadapp's contracts and the growing list of external protocols it integrates with. Treat an audit as a reduction in the probability of a certain class of bug, not as a guarantee.
Instadapp's track record and past incidents
Instadapp has operated since 2018 without a headline-making loss of user funds attributable to its own core contracts, which is a meaningfully long track record in DeFi terms. This does not mean nothing has ever gone wrong in the ecosystem it touches — protocols it integrates with, such as various lending markets, have had their own incidents over the years, and users of Instadapp inherited that exposure indirectly through their positions.
The more common source of loss for Instadapp users is not a contract exploit but ordinary DeFi mechanics: liquidations during sharp price moves, underestimating gas costs during network congestion, or approving a malicious front end that impersonates the real dashboard. Those risks exist regardless of which interface you use to reach the same underlying protocols.
Practical steps to use Instadapp more safely
Verify the URL every time, ideally from a bookmark you created after checking the official domain, since phishing clones are a persistent problem across all of DeFi and Instadapp is not immune. Never sign a transaction you do not understand, and be especially cautious of prompts that ask for broad token approvals rather than a specific amount.
Keep a comfortable buffer above the liquidation threshold on any borrowed position, size your first transactions small until you are confident in the interface, and treat Instadapp Lite's automation as a convenience rather than as insurance against a bad market. Reading the security and risks article on this handbook alongside this one gives a fuller picture of the categories of risk involved.
Read next
Frequently asked questions
+Is Instadapp safe to use in 2026?
Instadapp remains non-custodial with a long operating history and publicly available, reviewed code, which reduces but does not eliminate risk. Safety also depends on the lending protocols and oracles it connects to, and on how carefully you manage your own position.
+Has Instadapp ever been hacked?
There is no widely reported exploit of Instadapp's own core smart contracts resulting in a major loss of user funds. Users have been affected indirectly by incidents at protocols Instadapp integrates with, which is a distinct risk from Instadapp's own code.
+Does Instadapp hold my funds?
No. Positions live in a smart account you control, deployed to your own address. Instadapp's interface reads and sends transactions but does not take custody of assets at any point.
+What is the biggest real risk when using Instadapp?
For most users the largest practical risk is liquidation during a fast market move, followed by phishing sites that mimic the real interface. Smart contract failure is possible but statistically less common than these two everyday risks.
+Should I trust Instadapp more than using Aave or Compound directly?
Neither is automatically safer; you are adding a layer. Using Instadapp adds the DSA contract on top of the underlying protocol, which adds convenience and composability but also one more piece of code between you and your funds.
Primary sources
Everything on this page can be checked against the documentation and code below.
Related material
- Instadapp security and risk: what can actually go wrongThe real risk categories for Instadapp users: smart contract and connector risk, oracle failure, liquidation, automation limits, governance and phishing, with practical mitigations.
- Instadapp DSA smart accounts: the layer everything else stands onHow Instadapp DSA smart accounts work: connectors, atomic transaction bundles, authorities and delegation, plus practical patterns for managing multiple accounts safely.
- Getting started with Instadapp: your first safe sessionA careful first session with Instadapp: wallet setup, creating a smart account, reading the dashboard, making a first supply and the safety checks to run before every transaction.