By Vanessa Grellet, Managing Partner at Arche Capital
The most important development in asset management this year will not show up in any fund filing, and most of the industry has not heard of it. It is called a vault, it lives on blockchains, and it is doing what finance has promised for a decade: turning crypto from an asset you speculate on into a market you allocate to. Money is already moving, institutions are already arriving, and the next two years will decide who writes the rules.
What a vault actually is
A vault is an automated money market on a blockchain. Investors deposit assets, usually dollar-pegged stablecoins; a computer program pools the deposits; and the program lends or deploys the pool according to a written strategy that decides where the money goes, what counts as acceptable collateral, how much can be borrowed against it, and how returns are distributed. The program runs continuously, 24 hours a day, and it enforces its own rules.
The concept is not new. Yield aggregators have been automating the same deposit-pool-deploy-compound-redemption loop for years. What is new is the scale, the institutional plumbing being built around it, and the migration from a retail yield-chasing tool into something that looks like a managed fund. The closest traditional analogue is a managed fixed-income fund: the pool, the strategy, the manager, the distributions all exist on both sides. The differences are what matter. There is no custodian holding the assets and no fund administrator computing the NAV; the program does both jobs. There is no quarterly statement and no cutoff date; anyone can check the pool's holdings and price at any moment. And the "manager" is a team called a curator, whose authority comes from a set of cryptographic keys rather than a prospectus.
The curator is the single largest variable in a vault's outcome. A good curator rebalances before a market turns and cuts exposure when collateral quality deteriorates. A bad curator, or no curator, is where the money goes. Deposits sit in the program itself, not with the curator, and the curator's changes are logged publicly and auditable. That separation is real, and it is one reason the category has grown. But it also means the diligence question that matters most is the oldest one in money management: who runs this, and what do they have to lose?
The money is already moving
The growth numbers are not a prediction; they are a measurement. S&P Global counted roughly $10 billion in vault deposits as of September 2026, against $1.5 billion two years earlier. The most complete independent survey of the curated vault market, published in August by vaults.fyi, counted $11.29 billion spread across 856 vaults, 131 curators and 18 protocols. Note what happened underneath the growth: overall crypto lending activity contracted significantly over the same window while curated vaults expanded. That is not speculative froth chasing a headline rate. That is allocator behavior, capital rotating from structureless lending into vehicles with named managers, written parameters and a redemption mechanism.
The protocols themselves are now distinct enough to compare. Morpho, the largest, carries roughly $5.2 billion of the surveyed total and runs a minimal-trust model: every lending market is a single isolated loan-collateral pair with fixed parameters, and the risk management layer sits in the curated MetaMorpho vaults on top. Aave, the oldest and most established lending protocol, activated its V4 architecture in 2026 with an institutional layer called Horizon that allows regulated tokenized assets to serve as collateral. Spark, built by Sky on an Aave V3 fork, offers a simpler, more conservative single-protocol approach. The point is not which one wins. The point is that the category has matured enough to have distinct products with different risk profiles, which is what an investable market looks like.
The institutions are arriving
For anyone who has watched crypto's institutional overtures come and go, the difference this time is that the participants are not buying exposure. They are building infrastructure around the structure itself. Morgan Stanley is the clearest signal. In September, Bloomberg reported that the bank stood up a Digital Asset Lab, a ring-fenced environment testing stablecoins, tokenized deposits, tokenized money-market funds, central bank digital currencies and DeFi vaults without exposing its core banking systems. Scale is what separates this from the dozens of bank pilots before it: Morgan Stanley oversees roughly $9.3 trillion in client assets and more than 15,000 financial advisers, so anything that clears the lab has large internal distribution channels waiting for it. Its wealth division has already moved, arranging with Galaxy Digital to let eligible clients lend bitcoin, ether or Solana and potentially receive spot crypto ETP shares in return, with Galaxy cutting its $25 million minimum to $5 million for referred clients.
The institutional plumbing layer is deeper than most people realize. Fireblocks, which serves thousands of institutional clients, launched an Earn product in 2025 that lets enterprise customers generate yield on stablecoin balances through Morpho and Aave vaults directly from its platform. Coinbase and Binance both use Morpho's infrastructure for their lending services. IPOR, a specialist institutional access provider, builds regulated vaults that give traditional financial entities compliant entry points to Aave and Morpho liquidity. In a report on DeFi lending's modularization, Tiger Research noted that the institutional access layer has moved from "whether" to "how," with regulated partners building compliance wrappers around the raw protocol rails.
S&P Global Ratings launched its Vault Risk Assessment on October 4: a letter-based scale for lending vaults, graded across six risk factors — portfolio credit quality, liquidity mismatch, curator risk, blockchain risk, protocol risk, and vault security and governance. Note which factor sits third on the list. The largest rating agency in the world is formally saying that the biggest variable in a vault is the quality of the judgment of the people who picked the strategy. That is a fund-manager question, not a crypto question, and it is the moment the industry stopped pretending otherwise. The Depository Trust Company is the clearinghouse leg. In July, more than 30 firms used tokens created from assets held at DTCC in live production trades, and DTCC plans to open its tokenization service more broadly this month. Tokenizing a single security is settled technology; the question is whether tokenized cash, securities and collateral can work at institutional volume, and the vault is where that work gets tested.
Even the asset managers are showing up in the data. The vaults.fyi survey found institutions such as Bitwise, Apollo and JPMorgan Chase now engaging with the vault market. Banks do not stand up labs, rating agencies do not build risk frameworks, clearinghouses do not open tokenization services, and custody platforms do not launch yield products for hobbies.
The objection, and why it cuts the other way
The obvious pushback is the hacks, and it deserves to be stated plainly. In July, an attacker extracted about $6 million from two USDC vaults in a single transaction by manipulating the vaults' net asset value, donating over-valued tokens from a paused market into the share-price calculation. On October 4, the very day S&P announced its rating scale, a vault on the Base network lost about $6 million in wstETH after a freshly deployed contract was whitelisted and allowed to take the vault's Aave position.
The broader loss data, from Immunefi's six-year Ecosystem Vulnerability Audit, tells a more nuanced story than the headlines. DeFi protocol exploit losses peaked at $2.62 billion in 2022, fell to $534 million in 2024, and were $680.3 million in 2025. The median loss per incident dropped from $6 million in 2022 to $1.5 million in 2025. The first half of 2026 saw $972 million in losses, less than half of H1 2025, even as the incident count hit a record 207. More attacks, less damage: the security surface is widening, but the blast radius per failure is shrinking.
Read the 2026 vault incidents closely. Neither attack broke cryptography. Both were failures of administration: who controls the pricing inputs, who controls the whitelist, who watches the rules change. Those are precisely the failure modes that institutional capital is engineered to fix: continuous audit, named accountability, disclosure standards a risk committee can sit next to its other fund documentation. The hacks are not the argument against the institutions arriving. They are the argument for it.
Why this moment, and why you
Here is the part that should make sophisticated allocators uncomfortable. The concentration data: five curators control 69 percent of the curated vault market. Named curators in the Morpho ecosystem include Gauntlet, Steakhouse and Block Analitica, risk and analytics firms that have built their own institutional reputations around the quality of their parameter-setting. One protocol, Morpho, carries nearly half of the total market, roughly $5.2 billion of the $11.29 billion surveyed. A handful of teams run most of an entire asset class. That is a risk statistic, but it is also a window. The next $10 billion will be allocated against norms that are being written right now: what disclosure looks like, what audit standards look like, what a curator's skin in the game looks like. Whoever sets those norms gets the durable advantage, and the early allocators who demand them will be the ones who set them.
The opportunity is not in the money already in vaults. It is in the structure's demonstrated ability to move from speculation to asset management, and in the small set of operators building the track record that move requires. The technology is new. Every serious allocator already knows the questions: who runs the money, what are the rules, what happens in a downturn, and what have they got to lose. The vaults that answer best will earn the privilege of the next hundred billion dollars. At this point, "we don't do crypto" is no longer a neutral position. It is a decision to let others write the norms without you.
Sources and further reading
- S&P Global Ratings, "S&P Global Ratings launches Vault Risk Assessment for digital asset markets," press release, October 4, 2026: https://press.spglobal.com/2026-10-04-S-P-Global-Ratings-launches-Vault-Risk-Assessment-for-digital-asset-markets
- S&P Global Ratings, Vault Risk Assessment product page (analytical approach and letter-based scale): https://spglobal.com/ratings/en/products/vault-risk-assessments
- Wallfacer Labs / vaults.fyi, "The State of DeFi Curation 2026," August 2026 — market survey of 856 vaults, 131 curators, 18 protocols: https://wallfacerlabs.github.io/research/defi-curation/
- Cryptopolitan, "Morpho leads $11.3B curated DeFi market as five curators hold 69%," August 2026: https://www.cryptopolitan.com/morpho-leads-curated-defi-market/
- Bloomberg (via ETHNews), "Morgan Stanley Digital Asset Lab Tests DeFi Vaults and Stablecoins," September 29, 2026: https://ethnews.com/morgan-stanley-digital-asset-lab-tests-defi-vaults-and-stablecoins/
- Morpho network data (total value locked, deposits, vault assets under curation), as of October 5, 2026: https://data.morpho.org/
- Fireblocks, "Fireblocks Launches Native Yield on Stablecoin Balances," 2025: https://www.fireblocks.com/blog/earn-on-stablecoin-balances
- The Defiant, "Fireblocks Launches Stablecoin Yield Product via Aave, Morpho": https://thedefiant.io/news/defi/fireblocks-launches-stablecoin-yield-via-aave-morpho
- Tiger Research, "The Risk Management War Among Morpho, Euler, and Aave" — DeFi lending modularization and institutional access: https://reports.tiger-research.com/p/defi-lending-is-modularizing-the-eng
- IPOR, "Institutional Vaults: Regulated Access to Aave and Morpho": https://ipor.io/institutional-vaults/
- DeFi Intel, "Morpho vs Spark: 2026 Comparison" — protocol architecture and TVL data: https://defi-intel.com/compare/morpho-vs-spark/
- Immunefi, "The Ecosystem Vulnerability Scoreboard: 6 Years of DeFi Loss Data" — $2.62B (2022), $534M (2024), $680.3M (2025), median loss $6M to $1.5M: https://immunefi.com/blog/research/the-ecosystem-vulnerability-scoreboard-6-years-of-defi-loss-data/
- Immunefi, "June 2026 Immunefi Ecosystem Update" — H1 2026 losses of $972M, record 207 incidents: https://docs.immunefi.foundation/june-2026-immunefi-ecosystem-update/
- Lazy Summer Protocol, "Lazy Summer USDC Vault Exploit Post-Mortem," July 2026 — $6.04M NAV-manipulation attack: https://blog.summer.fi/lazy-summer-usdc-vault-exploit-post-mortem-what-happened-and-what-comes-next/
- PublicAML, "Base vault hack: $6M wstETH, Tornado gas, 1,000 wstETH in a 7-day bridge window," October 2026: https://publicaml.org/base-vault-hack/
- The Defiant, "What Is Yearn Finance?" — Andre Cronje, iEarn/yEarn origins, yVault architecture: https://thedefiant.io/education/blockchains/what-is-yearn-finance-2
- Alea Research, "Yearn Finance" deep dive — vault evolution, strategist/guardian roles, V1 through V3 architecture: https://alearesearch.io/reports/deep-dives/yearn-finance
