S&P Global Puts a Risk Score on $10 Billion of Crypto Lending Vaults

S&P Global has extended its ratings machinery into one of the least supervised corners of digital asset finance. The firm announced a framework for assessing digital asset lending vaults across six risk categories, arriving as deposits in the sector reach roughly $10 billion. That number is not large next to the $40 trillion US Treasury market, but it is large enough to matter, and it has been accumulating almost entirely outside the view of any rating agency, bank supervisor, or securities regulator. The arrival of S&P is the clearest signal yet that onchain credit has stopped being a hobbyist activity and started being a product that institutional allocators want a third party to grade.

The timing is not accidental. Vault deposits have roughly doubled over the past two years while the sector absorbed a string of losses that revealed exactly how little most depositors understood about where their yield came from. S&P is selling clarity into that gap. Whether it can deliver clarity, or merely the appearance of it, is the question worth spending time on.

The Vault Model That Grew to $10 Billion

A lending vault is a deceptively simple thing. A depositor sends an asset, usually a stablecoin, into a smart contract. The contract routes that capital into lending markets against collateral. Interest accrues. The depositor can withdraw, in theory, on demand.

What makes vaults different from the first generation of DeFi lending is the curator. On Aave in 2021, risk parameters were set by token governance votes, slowly and publicly. Protocols like Morpho and Euler unbundled that. They provide the lending primitive and let independent firms, Gauntlet, Steakhouse Financial, Re7 Capital, MEV Capital, Block Analitica, and dozens of smaller outfits, assemble vaults with their own collateral lists, loan-to-value ratios, and interest rate curves. The curator earns a performance fee. The depositor earns yield. The protocol earns a cut and takes no position on whether the curator's choices are sound.

This structure is efficient. It is also an almost perfect machine for transferring risk to people who cannot price it. A depositor on a vault dashboard sees an annual percentage yield, a total value locked figure, and a curator name. The depositor does not see that the yield is 14 percent because a quarter of the vault is lent against a thinly traded synthetic dollar whose backing is a trading strategy run by a team of four people. Yield is a single number. The reasons for that yield are a dozen numbers, and nobody was publishing them in a comparable format.

That is the hole S&P is stepping into. The firm already does something structurally similar with stablecoins, where it has published stability assessments on a one to five scale since late 2023 and has not been shy about the results. Tether, the largest stablecoin by circulation, sits at the weak end of that scale on the strength of its reserve composition and disclosure practices, while USDC scores substantially better. S&P also assigned Strategy, the largest corporate Bitcoin holder, a B- issuer credit rating in 2025, deep in speculative territory. The firm has demonstrated it will publish unflattering numbers about popular assets. Vault curators should expect the same treatment.

Six Categories and the Failures Behind Them

S&P has not published the full methodology to the public, and the six categories matter less than whether they map onto the ways vaults actually break. Recent history supplies the test cases.

Smart contract failure is the obvious one. In November 2025, an exploit in Balancer's stable pool math drained roughly $120 million across multiple chains, hitting integrations that had treated the code as battle tested after years of uneventful operation. Code that has not failed is not code that cannot fail.

Collateral quality is the second and, on the evidence, the more dangerous one. The Stream Finance collapse in late 2025 wiped out something close to $93 million after an off-chain fund manager lost depositor capital, and the damage did not stay contained. Several curated vaults had accepted Stream's synthetic dollar as collateral. Elixir's deUSD, which held exposure, wound down entirely. Depositors who thought they held a stablecoin lending position discovered they held an unsecured claim on a proprietary trading desk.

Curator discretion is the third. A curator can change a vault's collateral list without a depositor doing anything. Reward structures favor yield, because yield attracts deposits and deposits generate fees, and the depositor bears the downside. This is the classic agency problem that ratings agencies exist to price, and it is the category where S&P's judgment will be most contested.

The remaining failure modes are liquidity and redemption mechanics, oracle dependence, and off-chain counterparty exposure. Each has its own precedent. Each is a place where a vault can look solvent on a dashboard and be insolvent in fact. A framework that scores all six and produces a single comparable grade would be genuinely useful. A framework that produces a single comparable grade while compressing six incommensurable risks into it would be dangerous in a specific, familiar way.

Industry Welcome, Investor Skepticism

The industry case for ratings is straightforward and largely correct. Pension funds, insurers, and corporate treasuries cannot allocate to an asset their investment committee cannot describe in a memo. A rating is a shared vocabulary. If a vault carries an S&P assessment, an allocator can put it in a risk bucket, write a policy limit against it, and move on. Without that, onchain credit stays a crypto-native product funded by crypto-native capital, capped at a few tens of billions of dollars. Curators know this. The better ones have been publishing risk dashboards and attestations voluntarily for two years, precisely because they want to be ratable.

The skeptical case rests on a bill that has already been paid once. S&P rated subprime mortgage-backed securities and the collateralized debt obligations built on top of them as AAA, the same grade as sovereign debt, right up to the point where they defaulted. In February 2015, S&P paid $1.375 billion to settle with the US Department of Justice and nineteen states over that conduct. Moody's paid $864 million in January 2017. The business model that produced those ratings has not fundamentally changed: the entity being rated typically pays for the rating, and the agency competes for that business against other agencies. Apply that model to vault curators who are themselves competing on yield, and the incentive stack looks uncomfortably similar to 2006.

There is a second objection that cuts the other way. Vaults are, in one specific respect, more auditable than any structured credit product in history. The collateral is onchain. The loan-to-value ratios are readable by anyone with an RPC endpoint. Firms like Llama Risk and Chaos Labs already publish continuous public analysis, updated by the block, for free. A quarterly letter grade from a New York firm may be strictly less informative than the raw data, while carrying far more institutional authority. That is the worst combination: a number that travels further than its accuracy justifies.

Both objections are serious. Neither is a reason to prefer the status quo, where a retail depositor comparing two vaults has nothing but an APY figure and a logo.

Washington, Brussels, Basel

The regulatory backdrop makes the ratings question more consequential than it would otherwise be, because ratings are increasingly load-bearing in law.

In the United States, the GENIUS Act, signed July 18, 2025, brought payment stablecoins under federal rules and settled the question of what a dollar token is. It said nothing about what happens when someone lends that token into a smart contract. Market structure legislation covering that territory has been grinding through the Senate since the House passed its version in July 2025, and the SEC under Paul Atkins has shifted toward rulemaking and exemptive relief rather than enforcement. Nationally recognized statistical rating organizations are themselves regulated by the SEC under rules adopted after Dodd-Frank. If vault ratings become NRSRO output, they inherit that oversight and that liability.

The European Union has gone further and faster. MiCA became fully applicable on December 30, 2024, and credit rating agencies operating in the EU have been supervised by ESMA under the Credit Rating Agencies Regulation since 2011. A European allocator looking at a rated vault is operating inside a framework that already contemplates both halves of the transaction. The practical result is that EU institutional money may reach onchain credit through a cleaner legal path than US money does, which would be an unusual reversal.

Then there is Basel. The Basel Committee's prudential standard for banks' cryptoasset exposures took effect January 1, 2026, and assigns a 1,250 percent risk weight to Group 2 assets, which is a polite way of requiring a bank to hold capital equal to the full value of the position. Under that treatment, a bank does not care much whether a vault is rated A or B. The capital charge is punitive either way. Ratings will open vaults to asset managers, family offices, and corporate treasuries long before they open vaults to regulated banks.

Why Bitcoin Holders Should Care

Here is the part that the ratings framework cannot score. Every vault in this $10 billion sector is denominated in dollars, and the entire proposition is that a depositor should accept credit risk, smart contract risk, and curator risk in exchange for a yield quoted in a currency whose issuer has expanded its monetary base at will for a century. That is the trade. Take on six categories of risk to earn a return in units that the Federal Reserve and the European Central Bank can dilute by political decision. S&P can grade the six risks with total competence and still be measuring everything in a ruler that shrinks. Bitcoin's answer is narrower and better: 21 million units, a block subsidy of 3.125 BTC until the 2028 halving, no issuer, no discretion, no committee. Holding it yields nothing, and that is the point. Yield is compensation for risk, and the dominant risk in this sector is not a bad collateral list, it is the slow confiscation performed by the denominator. A rating that tells you a dollar vault is sound is answering a real question. It is not answering the more important one, which is whether you should be holding dollars at all.

This is not an argument against onchain credit. Credit markets are useful, and a transparent, overcollateralized, publicly auditable lending market is a genuine improvement on the opaque balance sheets of Celsius, which owed roughly $4.7 billion to about 600,000 Earn account holders when it filed for bankruptcy in July 2022, or Genesis, which owed $3.5 billion to its fifty largest creditors. Vaults at least show their work. The argument is that transparency about risk and honesty about money are different virtues, and the sector has made real progress on the first while ignoring the second.

What to Watch

First rated vaults by year end. S&P published stablecoin assessments within months of announcing that framework. Expect the first named vault assessments inside two quarters, and expect the largest curators on Morpho and Euler to be first in line, because they have the most to gain from a favorable grade.

A downgrade that moves deposits. The framework's credibility will be established or destroyed by its first negative action. If S&P cuts a large vault's assessment and deposits leave within days, the ratings have teeth. If a vault fails having never been downgraded, the 2015 settlement becomes the headline again and the framework is finished as an institutional reference.

Curator consolidation. Ratings favor scale. Compliance, disclosure, and the fee itself are fixed costs. Expect the long tail of small curators to shrink through 2027 as institutional deposits concentrate into a handful of rated vaults, with the sector's $10 billion likely held by fewer than a dozen names by the end of next year.

Spread compression between rated and unrated vaults. The clearest measurable effect will be rate divergence. Rated vaults should see deposit yields fall by 100 to 300 basis points relative to comparable unrated vaults, not because their risk changed, but because institutional capital accepts less return for a recognized grade. That spread is the price of the rating, paid by depositors.

Moody's and Fitch following within a year. Ratings is a three-firm business and no incumbent concedes a growing category. Once a second agency publishes a competing methodology, watch for grade inflation, the specific mechanism by which the last credit cycle's ratings failed.

The sector is getting a scorekeeper. That is progress. It is not safety, and nobody should confuse a letter grade with an understanding of what they own.

---

Go deeper: The Cantillon Effect

Source: Cointelegraph