DeFi lending vault deposits have grown from ~$4B at the start of 2025 to more than $10B by October 2026. That’s 2.5x growth in roughly 21 months. But the bigger story isn’t the capital entering these products. It’s the lending risk depositors are outsourcing in exchange for yield. Crypto lending vaults typically offer 3–10% returns, while riskier strategies can exceed 20%. That spread deserves scrutiny. Here’s where I think the risk becomes more interesting. » Curators are becoming the risk managers Take @Morpho. Its Vault V2 separates strategy from execution. Curators determine which markets and adapters are permitted and establish risk parameters. Allocators deploy capital within those rules. That creates a layer between the depositor and the underlying lending markets. But there’s an important technical detail: Morpho’s documentation says allocation caps aren’t continuously enforced ceilings. Exposure can move above a cap without a new allocation. A risk limit is useful, but it isn’t a guarantee that exposure can never exceed it. » APY doesn’t tell you how quickly you can exit Vault deposits are deployed into lending markets to generate returns. When borrowers use most of the available liquidity, the vault may not have enough assets immediately available to satisfy every withdrawal. Morpho explicitly distinguishes this situation from bad debt. A withdrawal delay doesn’t necessarily mean funds are lost. But it does mean that advertised yield and immediately available liquidity are two different metrics. » The real stress test is a collateral failure Suppose a borrower owes $10M against collateral initially worth $12M. If that collateral falls to $8M before liquidation can recover the debt, the position may leave the lending market with a shortfall. In Morpho Vault V2, bad debt reduces the value of the vault’s assets, and the loss is shared proportionally among depositors. The smart contracts can enforce the rules correctly and depositors can still lose money. That’s the distinction between protocol security and credit risk. » Look beyond the headline yield A useful comparison: Two Prime’s Bitcoin lending vault on Pareto launched with a target yield of 1.5 – 2% and roughly $10M of the firm’s capital committed to absorb initial losses. That doesn’t make it risk-free, and the strategy isn’t directly comparable to every DeFi vault. But it illustrates the questions I want answered: → How much collateral and market concentration sits behind the yield? → What proportion of deposits is immediately liquid? → Who can change the allocation, and what protections apply? → Is any manager capital committed to absorbing losses before depositors? → What happens to the vault’s share value when bad debt is recognized? DeFi vaults are making sophisticated lending strategies accessible to more capital. My take: growth in deposits shouldn’t be mistaken for better risk management. As more capital flows through curated strategies, the quality of the curator becomes just as important as the underlying protocol. I’d rather use a vault with transparent exposures, realistic withdrawal assumptions and clearly defined loss protections than chase an extra few percentage points of APY. In the long run, I think the vaults that earn lasting trust will be the ones that make their risks as visible as their returns.