S & P review impacts $10 billion in crypto lending-Treasury market

Standard & Poor's Global Ratings launches Crypto Lending Treasury Risk Assessment Framework

S&P Global Ratings officially launched the "Vault Risk Assessment"(VRA) framework on October 4, 2026, which aims to conduct a systemic risk analysis of the crypto asset lending treasury market. This market segment has experienced significant growth in two years, with deposits surging from $1.5 billion to approximately $10 billion. The move comes as a security company pointed to a suspicious money flow incident involving a loan vault on the Base blockchain network, amounting to approximately $6 million.

Core Points

• Standard & Poor's Global Ratings launched the VRA framework on October 4, 2026 to assess the risks of digital asset lending vaults.
• Currently, the total deposits in the crypto lending vault market are approximately US$10 billion, an increase of several times compared with two years ago.
• On the same day, security company CertiK discovered an abnormal fund flow incident involving a loan vault on the Base blockchain, involving an amount of approximately US$6 million.

Why S & P cares about crypto lending vaults

The operation model of crypto lending vaults is similar to a digital savings pool: users deposit cryptocurrency and the vault lends it to earn income. For a long time, major credit rating agencies have not applied structured risk analysis systems to these products as they do to traditional financial products. The lack of standardized information disclosure has also attracted wider regulatory attention.

S & P Global Ratings changed this by releasing the VRA framework. The framework is designed to provide investors with forward-looking advice to assess the relative risk of damage to treasury deposits (i.e. loss or significant reduction in value). Yann Le Pallec, senior executive officer of Standard & Poor's, said: "As digital assets continue to be institutionalized, the market needs an increasingly urgent independent risk assessment that connects traditional finance with decentralized innovation."

The VRA framework focuses on six specific dimensions:

1. Portfolio credit quality
2. Liquidity mismatch (Whether the treasury is able to satisfy withdrawal requests)
3. Curator risk
4. Blockchain risk
5. Protocol risk
6. Treasury security and governance

It needs to be clear that the VRA is not a credit rating and does not comment on the yields provided by the treasury. It is simply a view of relative risk, not a guarantee of capital recovery.

Loan vault market size

According to S & P data, as of September 2026, the total deposits of digital asset lending vaults reached approximately US$10 billion, compared with only US$1.5 billion two years ago. This six-fold increase reflects the rapid influx of institutional and retail capital into these products, despite the lack of independent risk benchmarks similar to traditional bond or money-market fund markets. S & P entered this field precisely to fill this gap.

Impact of the $6 million Base incident

On the same day that S & P released the framework, blockchain security company CertiK warned of suspicious financial flows on the Layer-2 network Base above Ethereum. According to CertiK's public alert, a newly deployed proxy contract (an automated program that redirects transactions) was used to borrow approximately 1,783 aBaswstETH from a lending vault. These positions were subsequently redeemed through Aave, one of the largest crypto lending agreements, to approximately 1,783 wstETH, which was valued at approximately $6 million at the time.

It must be clarified that CertiK's alert only described the "suspicious nature" of the flow of funds and did not confirm permanent damage, identify attackers, or provide transaction hashes. At present, the relevant mechanism is still under investigation, and the final results of depositors have not yet been independently verified.

Although no losses were confirmed, the incident illustrates the type of risk that S & P's new framework is designed to assess. The newly deployed agent contract interacts with the treasury, borrows assets and transfers them through agreements, which is the scope of activities covered by the "Treasury Security and Governance" and "Protocol Risk" dimensions of the VRA. The decentralized finance (DeFi) ecosystem has experienced repeated bridging and treasury incidents that have damaged depositors 'confidence, making the value of independent risk assessments even more prominent.

Enlightenment for the US$10 billion lending vault market

标普的VRA是一个重要里程碑，因为它将传统金融领域的知名机构引入了 largely 缺乏独立第三方风险意见的市场。对于考虑存入加密借贷金库的用户而言，VRA评分未来可能起到类似债券评级的作用：由无利益关联方出具的相对安全性速记信号。

标普明确表示，个别金库的评估将在未来的公告中发布，因此目前尚无公开的实时VRA等级。此次框架发布仅是基础，而非最终产品。监管发展（如投资顾问加密托管规则的演变）可能会决定此类独立风险评估是成为市场标准还是保持自愿性质。

对于普通加密货币持有者而言，当前的直接启示是明确的：如果您使用或考虑使用加密借贷金库，正式风险评估框架的到来意味着关于您所选择金库具体风险信息的可能即将增加。在个别VRA等级发布之前，尽职调查仍由用户承担：检查金库如何管理流动性、谁控制其治理结构，以及其智能合同是否经过独立审计。

本文仅供参考，不构成财务或投资建议。加密货币和数字资产市场存在重大风险。在做出决策前，请务必进行独立研究。