Crypto vaults pass $10 billion, and regulators now ask who the curator answers to

Money parked in crypto lending vaults has passed $10 billion, up from about $4 billion at the start of 2025, according to the Financial Times, as reported by CoinDesk on 19 October 2026. Typical returns run from 3% to 10% a year, and riskier strategies pay 20% or more, the same report says. The main depositors are fintech companies, digital-asset treasury firms and hedge funds.

The size is new. The question it raises is not. Each of these DeFi vaults is run by a curator, a private firm that decides where depositors’ coins are lent, and since July three institutions have looked at exactly that role: an SEC commissioner in a personal statement, the EU markets supervisor ESMA in recommendations to the European Commission, and S&P Global Ratings with a new vault risk grade. None of them is a law or an enforcement case, and none names a vault or a curator as a wrongdoer.

The one real stress test so far came in November 2025, when the Stream Finance and Elixir collapse left losses inside several curated vaults on Morpho, Euler and Silo, and some depositors took haircuts of up to 12%.

DeFi vaults at $10 billion: three counts, three baselines

The $10 billion number is the Financial Times’ figure. Coindaro could not read the FT article, and neither CoinDesk nor the other outlets that relayed it say which vaults the newspaper counted or which data provider it used. CoinDesk names no one and quotes no one beyond the FT.

S&P Global Ratings arrives at a similar total by its own route. In the press release launching its vault grades on 4 October, the agency put vault deposits at US$10 billion as of September 2026, against US$1.5 billion in September 2024. The two series start from different dates and probably different definitions, so the jump from $1.5 billion and the jump from $4 billion are not in conflict.

Public dashboards do not give one clean answer either. On DefiLlama, data fetched on 19 October between 10:25 and 10:47 UTC, the lending network Morpho alone showed $11.16 billion of total staking or liquidity, measured at current market prices. It is the main size metric in DeFi.">value locked. The site’s “Risk Curators” category added up to about $9.58 billion across 93 entries with value locked, and its “Onchain Capital Allocator” category to about $9.40 billion across 78. These buckets overlap with each other and with Morpho’s own number, because the same dollar is counted once at the protocol and again at the curator that steers it. Adding them would double count.

So the FT figure sits in the range the public data shows. What it covers depends on what one calls a vault.

Two lines in that table say a lot about the business. Steakhouse Financial grew almost tenfold since January 2025, while Gauntlet a bit more than doubled. Euler, one of the lending markets hit by Stream, never came back to its pre-crisis size.

What a DeFi vault curator does with your deposit

A vault is a blockchain that runs exactly as written when it is called, holding and moving funds according to its code, without an intermediary able to change the outcome.">smart contract holding reserves of two or more tokens, supplied by users, that a decentralized exchange uses to execute trades automatically at a price set by a formula.">pool held by a smart contract. You deposit a token, often the USDC stablecoin, wrapped bitcoin (WBTC) or ether, and you receive a receipt token that tracks your share. The contract then lends the pool to borrowers, who post other crypto as collateral and pay interest. That interest, minus fees, is the yield shown on the vault page.

The curator sets the rules of the pool. It chooses which lending markets the vault may use, which collateral it accepts, how much may go into each market and when to move money between them. In exchange it takes a performance fee. CoinDesk compares the role to an investment manager, and the comparison is close: the depositor hands over the coins and the judgement.

On Morpho, the lending network behind Coinbase’s bitcoin loans, anyone can open an isolated market with one collateral asset and one loan asset, and vaults bundle several of those markets under a curator’s allocation. The names readers meet most often are Steakhouse Financial, which works with Morpho and Coinbase, Gauntlet, which curates Morpho vaults linked to Binance, Chaos Labs on Kraken’s DeFi Earn products, and Sentora as risk manager on a Kraken vault, according to a Tiger Research overview on CoinGecko Learn updated on 7 August 2026.

The risks sit in places a depositor rarely looks:

• Collateral can be an illiquid token, a stablecoin backed by other crypto or a tokenised private loan, and it may be hard to sell when prices fall.
• The price feed, or oracle, decides when a borrower is liquidated; a feed that lags or is fixed can stop liquidations from firing.
• Automatic liquidations can push prices lower in a sell-off and feed on themselves.
• Code bugs, hacks and curator mistakes can all cause losses, and a withdrawal depends on borrowers repaying or being liquidated.

There is no deposit insurance on any of this. A vault paying 8% is not a savings account paying 8%. Our guide to DeFi lending, yields and risks covers the mechanics in more depth.

The SEC: one commissioner’s statement, no investigation

CoinDesk writes that the SEC “has raised questions” about vaults holding securities. The only SEC document on the subject that Coindaro found is a statement by Commissioner Hester Peirce, who leads the agency’s Crypto Task Force, published on 22 July 2026 under the title “Headstands and Summervaults”. It is one commissioner’s view. It is not a Commission rule, an order or an enforcement action, and it names no firm. No public SEC case against a vault or a curator is known, and an August 2026 client alert from the law firm Croke Fairchild said the SEC had not sent Wells notices, the letters that usually precede charges, to major vault curators.

Peirce’s message is that putting an activity onchain does not take it out of securities law. She describes vaults on a range from fully programmatic to discretionary. Depending on the structure, she writes, a vault may form a common enterprise if users expect profits from the “entrepreneurial or managerial efforts” of the deployer and the curator, may fall into investment company territory if it holds or allocates to securities, and may raise investment adviser questions. Onchain loans themselves can resemble notes that are securities.

Her conclusion leaves the question open. Whether a given vault is covered “will come down to the specific facts and circumstances”, the statement says. It also warns builders against strained readings of the law: “you will have a painful fall”. And it ends with an invitation, saying the SEC welcomes thoughts on whether its rules should change to accommodate vaults and onchain lending.

Markets noticed. The MORPHO token fell about 5% right after the statement, according to CoinGecko Learn. For the wider picture of how US rules are being written without new legislation, see our piece on how the SEC and CFTC are shaping crypto rules after the stalled CLARITY Act.

ESMA: recommendations for DeFi gateways, not rules for vaults

On 30 September 2026 ESMA published its response to the European Commission’s consultation on reviewing MiCA, the EU’s crypto-asset law. These are recommendations to the Commission. Nothing changes until the Commission proposes amendments and EU lawmakers adopt them, and no timetable has been confirmed.

Two proposals matter for vaults. First, ESMA wants a new regulated service for licensed crypto firms that give clients access to DeFi, including lending and borrowing protocols and what it calls yield-generating strategies. A firm acting as that gateway would have to disclose DeFi risks, be open about how it selects protocols and routes client activity, manage conflicts of interest, carry out due diligence on the protocols it offers and meet cyber-security requirements. ESMA says the duties should be proportionate to how much control the firm has over the protocol.

Second, ESMA wants the DeFi exemption in MiCA kept as narrow as possible. Recital 22 leaves out services provided in a fully decentralised manner, and ESMA says diverging readings of that notion have increased the risk of “decentralisation washing”, where an identifiable operator uses DeFi language to avoid MiCA. It asks the Commission to write a definition of DeFi into the law, or to let ESMA issue technical guidelines. Its press release sums this up as a call for “clearer criteria for determining which activities can be considered genuinely decentralised”.

The document does not mention vaults or curators by name. Its target is the access layer: exchanges, apps and aggregators that send EU clients into DeFi. A curator would be caught only indirectly, when a regulated firm has to vet the vault it lists. Separately, ESMA describes lending programmes run by crypto firms as “effectively black boxes for clients” and asks for consent and disclosure rules. That passage is about centralised providers, but the details ESMA says clients are not told (who borrows, what collateral is posted, the gross yield) are the same ones vault depositors struggle to see. Our MiCA guide explains how the current rules apply.

S&P’s vault risk assessment is a grade, not a credit rating

S&P Global Ratings launched its Vault Risk Assessment on 4 October 2026. The agency defines it as a forward-looking opinion on the relative risk of impairment to an investor’s position in a lending vault. It looks at six areas: portfolio credit quality, liquidity mismatch, curator risk, blockchain risk, protocol risk, and vault security and governance. Grades use letters with a “(v)” suffix, AAA(v) marking the lowest risk, according to crypto.news.

The limits are in S&P’s own words. “A VRA is not a credit rating and does not comment on yield levels,” the release says. A strong grade should not be read as a guarantee against losses, S&P added, as quoted by crypto.news. No vault has been graded yet: S&P says initial assessments will come “in future announcements”, with no date.

Curator risk is listed as a factor in its own right, which matches the regulators’ focus. James Wiemken, who heads S&P’s global ratings services, pointed to “varying disclosure standards” in the market as the reason for a standard, independent view.

Stream and Elixir: the November 2025 test of curated vaults

The case that shaped all of this started with the market crash of 10 October 2025, which liquidated leveraged positions run by an external fund manager for Stream Finance. On 4 November Stream disclosed a loss of about $93 million tied to that manager and halted deposits and withdrawals. Its xUSD token, meant to hold $1, fell to about $0.26 at its 24-hour low, and roughly $160 million of deposits were frozen, according to case studies by Pharos and Sentora.

Curated vaults made it worse. Several vaults on Morpho, Euler and Silo valued xUSD at a hard-coded $1, so their liquidations never triggered as the market price collapsed. Two days later Elixir’s deUSD stablecoin, about 65% of whose backing had been lent to Stream through a Morpho market, fell roughly 98%. Elixir halted minting and redemptions and later set up a claims process for holders from before the event.

Some curators published their own exposure. Re7 Labs reported $14.65 million in an isolated xUSD/USDT0 market cluster on the Plasma network and $12.75 million in sdeUSD and deUSD collateral across four Euler and Morpho markets, Protos reported on 6 November 2025; a later Re7 post, cited by Protos on 18 November, split a similar total between deUSD and Stable Labs’ USDX. MEV Capital listed about $34 million of assets affected by the shortfall across four lending markets and one vault, and its own posts put the haircut for depositors in its Morpho USDC vaults at 3.5% on Ethereum and 12% on Arbitrum, according to Protos. Larger figures circulated for other curators, but they came from analysts, not the firms, and Coindaro has not confirmed them.

The damage showed in the dashboards. On DefiLlama, Euler v2 went from about $1.63 billion of value locked on 2 November 2025 to $1.03 billion on 13 November, a drop of about 37%, and Compound paused several stablecoin markets. Morpho dipped from $7.45 billion on 5 November to $7.07 billion on 12 November, then grew past $11 billion by September 2026. How much depositors finally lost, after claims and recoveries, has not been published. A Stream entity filed a lawsuit in December 2025 alleging misuse of funds; the claims are contested.

What it changes for depositors in the US and Europe

For now, nothing in the rules. No regulator has ordered any vault to close or register, and none of the three documents bans anything. What has changed is the vocabulary. The curator is no longer described as a neutral software role but as a manager whose discretion may carry legal duties, in the US under securities law and in the EU through the firms that list vaults.

The one named product in the CoinDesk report shows the spread: Two Prime, a bitcoin-backed lender, opened a bitcoin vault on Pareto in September that targets 1.5% to 2% a year, requires at least 5 WBTC and puts about $10 million of the firm’s own capital in a first-loss position. At the other end, strategies paying 20% or more have to get that yield from somewhere: borrower interest, trading, token incentives or a mix.

The questions a depositor can check on a vault page are concrete. What collateral does the vault accept, and how does its price feed work? Who is the curator, and what has it disclosed after past incidents? How fast can money come out? None of this is advice, and S&P’s grades, once published, will cover only the vaults it chooses to assess.

In Europe, MiCA today covers licensed providers, not fully decentralised protocols. Coindaro found no statement on DeFi vaults from France’s AMF or Italy’s Consob as of 19 October.

Still unknown, and the dates to watch

Several gaps remain. The FT’s dataset is not public. S&P has not named the first vaults it will grade. The European Commission has not said when it will propose MiCA amendments; secondary sources point to a review report in 2027, which Coindaro has not confirmed. In the US, no SEC action on vaults is scheduled, and Peirce’s door is open to firms that want to talk.

The next concrete marker is S&P’s first published grades, for which the agency has given no date.