S&P Global Ratings said on Oct. 4 that it has launched a risk assessment framework for digital asset lending vaults, called Vault Risk Assessment, or VRA. The move marks the first time a traditional ratings firm has set out a structured standard for evaluating risk in DeFi lending products.
Six categories shape the assessment
According to S&P Global’s announcement, the VRA framework reviews vault risk across six dimensions: portfolio credit quality risk, liquidity mismatch risk, curator risk, blockchain risk, protocol risk, and vault security and governance risk. A material weakness in any one of those areas lowers the overall assessment.
Lisa Schroeer, an analyst at S&P Global Ratings, said a major weakness in any single dimension would constrain the overall VRA score, adding that 「strong performance in one dimension cannot offset a material weakness in another」.
The structure reflects how crypto lending vaults work in practice. Onchain yield products contain several points of failure, and a breakdown in any one of them can lead to investor losses.
S&P says vault assets have climbed to about $100 billion
S&P said digital asset lending vaults held roughly $100 billion as of September, compared with $1.5 billion two years ago. These products pool investor funds and deploy preset strategies through smart contracts or human curators. Investors hold tokens representing their share and receive the associated yield.
The segment has expanded quickly over the past year, driven in part by exchanges, wallets and DeFi platforms rolling out packaged yield products.
- Telegram Wallet launched self-custodial BTC, ETH and USDT vaults in February, using infrastructure from Morpho, TAC and Re7.
- Kraken followed in May with a bitcoin yield vault powered by Veda and curated by Sentora. S&P said the product attracted $30 million from 4,000 wallets within 10 hours of launch.
In September, Kraken extended that model to tokenized securities, launching yield vaults tied to Nvidia, the SPDR S&P 500 ETF and the Invesco QQQ ETF. Sentora deploys those tokenized assets through DeFi lending markets. The products combine traditional financial assets with DeFi yield strategies.
Recent cases put governance and transparency in focus
The risks are not hypothetical. In August, Ethereum fixed-rate lending protocol Term Finance was attacked through a governance flaw. The attacker exploited governance control over its Meta Vaults and stole about $8.5 million.
PeckShield said the attacker withdrew 2,843 ETH, worth about $6.9 million, and 1.68 million USDC, which was later converted into DAI. The firm also said the address had previously received funds linked to Tornado Cash laundering activity.
Another dispute surfaced in late September around Solv Protocol’s BTC+ product. Users said about 50 BTC deposited into the product could not be redeemed after a July security incident. Solv said a single transaction had triggered a risk review and that the assets remained intact within the protocol. Even so, the episode highlighted pressure points around risk controls and transparency.
Not a credit rating and not a yield guarantee
S&P said the VRA measures the risk of investor loss. It is not a credit rating, and it does not assess or guarantee returns.
The firm also said it does not single out one of the six dimensions as the most important. Risk exposure depends heavily on product design, and different vaults can show different concentrations of risk.
Schroeer said the goal of the framework is 「to provide greater transparency around risk so that any institution deciding how to allocate capital to DeFi vaults can make more informed judgments」.
S&P said it will publish its first batch of VRA assessments in future announcements, but it has not disclosed which vaults will be reviewed first.
U.S. regulatory treatment remains unsettled
Crypto vaults remain in a regulatory gray area in the United States. SEC Commissioner Hester Peirce said in July that some vaults and onchain lending products could trigger federal securities laws, depending on how they are structured and operated.
Peirce said products that involve discretionary decisions over asset allocation, yield strategy, lending terms or liquidation thresholds could fall under requirements tied to securities, investment companies or investment advisers.
A traditional ratings firm enters a growing market
The $100 billion figure shows crypto lending vaults are no longer a niche corner of the market. S&P Global’s decision to introduce VRA brings a traditional ratings institution into that sector.
For now, S&P has framed the product as a transparency tool rather than a market pass. It has not said how institutions may use the assessments in practice, and the U.S. regulatory position is still unresolved.
For investors, the framework offers a method for identifying risk, not protection from loss. The Term Finance and Solv Protocol cases show that governance flaws, risk review procedures and redemption transparency remain central issues for vault products.