Deposits in onchain lending vaults have reached $10 billion. S&P Global Ratings has introduced a risk assessment built specifically for these vaults. The framework judges the human curator as
S&P Global Ratings has introduced a Vault Risk Assessment for onchain lending vaults, a segment of decentralized finance where deposits climbed from roughly $1.5 billion in September 2024 to $10 billion in September 2026, according to the agency’s own figures. The 567% increase matters less than what the money now sits in. Depositors are handing capital to specialist firms that choose collateral, set exposure limits and move funds between lending markets, which places a sector built to remove financial intermediaries in the position of needing an outside party to grade them.
Onchain vault deposits, per S&P Global Ratings
September 2024$1.5B September 2026$10B +567% in two yearsMorpho, one of the largest lending protocols, lets anyone create a lending market. The protocol’s documentation concedes that selecting among those markets, evaluating collateral and monitoring risk continuously requires specialist knowledge, and independent firms known as curators have stepped in to do that work. A curator decides which markets a vault may lend into, what collateral is acceptable, how much exposure each position can carry and when deposits should be reallocated. The smart contract executes the strategy. A firm designs it.
Morpho says Steakhouse Financial alone manages more than $2.2 billion across its vaults, up from $1.5 billion a year earlier. Distribution has moved to mainstream platforms as well: Coinbase’s USDC lending product and Robinhood Earn had each passed $500 million in deposits by September 2026, according to Morpho. A retail customer on either app now sits at the end of a chain that runs from fintech front end to curator to lending protocol, and most of that chain barely existed three years ago.
Anyone can inspect a vault’s balances and transactions onchain. S&P’s argument is that this gives a snapshot of positions at a given moment while disclosure of strategy and risk remains limited, and Morpho’s own risk documentation supports the point with specifics.
An oracle, the data feed that supplies asset prices to a lending market, can overvalue collateral and leave loans undercollateralized without triggering liquidations. In Morpho Vault V2, bad debt from an underlying market flows directly into the vault’s value, and depositors absorb it in proportion to their holdings. Withdrawals can stall temporarily if borrowers have taken all available liquidity. Owners, curators, allocators and sentinels hold significant powers over a vault, which makes the identity and security practices of whoever controls those roles a material question for depositors.
None of this can be read off a block explorer. It requires judgment about people, collateral and contingency, which is the work rating agencies have always sold.
S&P evaluates six factors and expresses the result on a scale that borrows its familiar letter symbols with a “(v)” suffix, where AAA(v) indicates the lowest relative risk of impairment.
What the Vault Risk Assessment examines 1Portfolio credit quality Risk in the assets and lending markets the vault holds Financial 2Liquidity mismatch Whether depositors can withdraw while funds are lent out Financial 3Curator risk Ability and willingness of the manager to hold the vault’s risk profile Human 4Blockchain risk Vulnerabilities of the underlying network Technology 5Protocol risk Weaknesses in the lending protocols that receive the assets Technology 6Security and governance Smart-contract security, controls and administrative powers TechnologyThe assessment is not a credit rating, and S&P says so explicitly. It does not measure a vault’s ability to meet payment obligations, and it takes no view on whether the yield is attractive. It ranks the relative likelihood that a depositor’s position ends up impaired. A reader who sees AAA(v) and assumes parity with a AAA bond has misread the scale.
OpenZeppelin’s contracts have underpinned more than $37 trillion in transferred value, by S&P’s count, and the firm has completed over 900 security engagements. S&P said the acquisition would extend its reach into onchain technology risk and support new security assessments. Less than three weeks later it published a methodology in which protocol, blockchain, security and governance risk account for half the factors. A traditional agency grades creditworthiness. An onchain product adds collateral, curator, protocol, contract and network risk on top, and S&P has been buying or building the capacity to cover each one.
DeFi users have long chosen products by headline yield. A vault paying 11% looks better than one paying 5% until the depositor learns that the first accepts illiquid collateral, runs tighter liquidation thresholds and gives its curator wider discretion. Because the S&P assessment deliberately says nothing about yield, it can sit beside the market rate and allow the kind of comparison fixed-income investors make routinely: return against a standardized measure of risk.
Institutional allocators stand to benefit first, since many cannot hold an instrument without an independent risk opinion on file. Curators face a different pressure. A firm managing billions will have its competence and discipline scored against rivals for the first time, and fintech platforms that distribute vaults to retail users gain a reason to favor those with an assessment attached.
The agency’s record with Sky Protocol suggests how strict that scoring may be. On October 1, S&P reaffirmed Sky’s B- rating, deep in speculative-grade territory, citing governance concentration, capitalization and growing ecosystem complexity. Sky is among the oldest and largest names in DeFi. Vault curators hoping for scores near the top of the (v) scale will be judged by the same analysts on several of the same weaknesses.
The post DeFi Lending Hits $10 Billion – Now S&P Wants to Measure the Risk appeared first on ETHNews.
