Curated DeFi lending vaults explained: who sets the risk, and who pays when it goes wrong
Vaults run by risk curators now hold billions on Morpho and Euler. A guide to how they work, what broke in the past year and what depositors should check.
DEFIANALYSIS
Sofia Marchetti
10/28/20263 min read
One of the quiet structural changes in DeFi lending over the past two years has been the rise of the curator. Instead of depositing stablecoins into one large pool governed by a DAO, a growing share of lenders now hand their funds to a vault managed by a specialist firm that decides where the money goes. Morpho, the protocol most associated with this model, has grown to roughly $11.4 billion in total value locked according to DefiLlama, and it gained deposits in late October while most of the sector shrank. The model is popular for good reasons. It also moves risk to places many depositors do not look.
How a curated vault works
The basic building block is an isolated lending market. Each market pairs one loan asset with one collateral asset, an oracle that prices the collateral, and a maximum loan-to-value ratio. Because markets are separate, a problem with one collateral type does not automatically spill into the others, which is the main difference from the pooled design used by Aave V3 and Compound.
A vault sits on top of many such markets. Depositors put in, say, USDC, and the curator allocates that USDC across markets it considers safe and profitable. The curator chooses which collateral to accept, how much exposure to allow in each market and which oracles to trust. In return it takes a performance or management fee. Depositors receive the yield, and they also absorb any losses. The smart contracts enforce the rules, but people decide what the rules are.
According to research by Chorus One, assets in curated vaults grew from about $300 million to around $7 billion in under a year, and the five largest curators controlled close to 43% of that total. Gauntlet and Steakhouse Financial were among the biggest, managing roughly $1.9 billion and $1.3 billion respectively at the time of that study. A small group of risk managers, in other words, now shapes credit decisions for billions of dollars of on-chain lending.
What went wrong
The weakness of the model became visible in November 2025, when Stream Finance disclosed that an external fund manager had lost about $93 million and halted withdrawals. Its xUSD token, which several curated vaults on Morpho, Euler and Silo accepted as collateral, fell to around $0.26 within a day. The problem was made worse by oracles that kept valuing xUSD at or near $1, so loans backed by it were never liquidated. Analysts at Yields and More estimated total ecosystem exposure at about $285 million, and Elixir's deUSD, which had lent heavily to Stream, collapsed almost completely.
A similar pattern repeated in March 2026, when an attacker minted tens of millions of Resolv's USR stablecoin using a compromised key. A wrapped version of the token was priced by a hardcoded oracle at $1.13 while it traded far lower on the market, and several lending venues paused markets. In both cases, Morpho's and Euler's core contracts worked as designed. The losses came from curator choices: which collateral to list, how to price it and how much exposure to allow.
A checklist for depositors
Anyone putting funds into a curated vault should treat it more like choosing a fund manager than opening a savings account. Five questions cover most of the risk.
First, what collateral does the vault lend against? A vault advertised as a USDC vault may lend to borrowers posting synthetic stablecoins, yield-bearing tokens or tokenized credit. Each of those has its own failure modes. Second, how is that collateral priced? Market-based oracles can be manipulated in thin markets, while hardcoded or redemption-rate oracles can hide a depeg until it is too late. Neither is perfect, but the choice should be disclosed and explained.
Third, how concentrated is the vault? Exposure caps per market matter more than the headline yield. A vault with a third of its funds in one novel collateral type carries a very different risk from one spread across blue-chip assets. Fourth, how quickly can you exit? When utilization reaches 100%, lenders may have to wait for borrowers to repay or be liquidated before they can withdraw. Fifth, what is the curator's track record, and how does it get paid? A fee tied only to assets under management can reward growth over caution.
Where the model goes next
Curators are responding to last year's failures. Some have tightened collateral lists, others publish exposure dashboards, and new credit-underwriting services aim to give vault managers better data on borrowers and collateral issuers. On the protocol side, Aave's move to a hub-and-spoke design in V4 brings it closer to the isolated-market approach, a sign that the industry now treats risk separation as a baseline.
The broader point is that DeFi lending has become a layered business. The base protocol supplies neutral plumbing, curators supply judgment, and depositors supply capital. That structure can be more efficient than a single DAO voting on every parameter. It only works, however, if depositors understand that the yield they earn is payment for a credit risk that someone has chosen on their behalf.