DeFi lending vaults have become one of the fastest-growing corners of the crypto market this year, with capital locked across the segment climbing from $4 billion at the start of 2025 to $11.29 billion today, spread across 856 vaults on 18 protocols. That marks 39% growth over twelve months, even as deposit capital elsewhere in DeFi fell 41.8% over the same period.
The scale of the shift invites comparison with a different moment in crypto lending history. On June 12, 2022, Celsius froze all customer withdrawals; the firm filed for bankruptcy protection the following month, with liabilities of over $4.7 billion set against just $1.75 billion in digital assets. The episode remains the reference point for what happens when a yield-bearing custodian cannot meet redemptions.
A concentrated market
Formally, 131 curators oversee the current vault landscape. In practice, the top five manage 69.3% of all capital, and their underlying credit markets overlap by up to 94.7%. That overlap means a problem at one curator's positions can propagate quickly through the others, since they are often exposed to the same collateral and counterparties rather than genuinely diversified books.
There is also a single-asset dependency running through part of the market. An analysis of the top 25 Morpho stablecoin vaults found that 54.1% of the $3.71 billion examined is Bitcoin-based collateral, with more than $2 billion in stablecoin assets ultimately tied to Bitcoin's price holding steady.
Yields and the exploits behind them
Returns vary widely depending on strategy. Normal vault strategies yield between 3% and 10%, while riskier, non-guaranteed strategies advertise more than 20%. Among 535 USD vaults analyzed with a direct withdrawal mechanism, the median 7-day yield was 3.84%; vaults requiring a multi-step exit process showed a higher median of 4.82%, reflecting the premium investors demand for locking up liquidity.
That liquidity has already been tested by a string of incidents this year. On March 22, 2026, attackers compromised the signature infrastructure of the Resolv protocol, using deposits of between 100,000 and 200,000 USDC to mint roughly 80 million uncollateralized USR tokens and extract approximately $25 million. On April 18, 2026, KelpDAO was exploited for 116,500 rsETH, which attackers then used as collateral on Aave to take out around $193 million in loans.
By September 22, 2026, total recorded loan defaults on major Ethereum DeFi protocols reached $181.5 million, with Aave V3 accounting for approximately $125 million and Compound V3 for approximately $52.5 million of that figure.
For European investors increasingly exposed to these vaults through structured yield products, the combination of concentrated curatorship, overlapping credit markets and a running tally of exploit-driven defaults marks a market whose growth has outpaced the diversification of its risk.
