S&P Global Just Launched a Risk Framework for Onchain Lending Vaults. The Agency That Grades Trillions in Debt Is Getting Ready to Grade DeFi.

The Old Men·October 11, 2026

Subscribe Free. The weekly briefing is free, always.

This week, S&P Global Ratings published a formal framework for assessing risk in onchain lending vaults, a corner of DeFi that S&P says held $10 billion in deposits as of September, up from $1.5 billion two years earlier. Days later, Moody’s issued its first-ever rating on a stablecoin protocol: a B3 counterparty risk rating for Sky Protocol, the issuer of the USDS stablecoin, solidly in junk territory and the same rung as the B- that S&P gave Sky in August 2025. These are two different instruments. Moody’s issued a credit rating. S&P’s vault assessment, by S&P’s own description, is not one. Two of the institutions that decide what pension funds, insurers, and bond desks are allowed to buy just stepped deeper into DeFi, and the first grade Moody’s handed out sits six notches below investment grade.

We have spent the better part of a year tracking Wall Street’s slow walk into tokenization: Wells Fargo’s tokenized deposits in August, the twenty-one-bank stablecoin venture in September, DTCC moving live trades onto blockchain rails in July, the SEC’s conditional exemption for tokenized equities. None of those stories involved the firms that actually gatekeep institutional capital. Banks can build the rails. Exchanges can list the tokens. But a pension fund’s investment policy statement does not ask whether an asset is tokenized. It asks whether the asset is rated, and by whom. That question had only scattered answers in DeFi until this week.

The timing is not an accident. The RWA Foundation’s Q3 report put the tokenized credit market at $6.2 billion as of October 1, down 2.8% from $6.35 billion in early July, even as holder counts rose 12.1% for the quarter. The report also flags issuer concentration risk: two issuers hold more than 60% of the market between them. That is a market with enough scale to attract a rating agency’s attention, and enough concentration, in a quarter when the total shrank, to worry one. Separately, Senator Blumenthal has asked the Treasury and the Justice Department to examine Tether, both its sanctions compliance and its ties to Cantor Fitzgerald, the firm that manages much of its reserves. It is part of a steady drumbeat of political pressure on the largest stablecoin issuer. Put those threads together and the spread of formal ratings and risk grades in this market looks less like innovation and more like something that had to happen eventually.

What a Credit Rating Actually Buys You in DeFi

Twenty years on institutional trading desks, ten of them at Morgan Stanley, teach you what a rating is actually for. It is rarely a prediction. It is a permission slip. Insurance companies, pension funds, and large swaths of fixed income mandates are contractually or regulatorily barred from holding assets below a certain grade, or from holding anything unrated at all. A B3 does not just describe Sky’s credit profile; it tells every compliance department at an investment-grade-only shop to stay away, while quietly opening the door for the smaller pool of capital mandated to chase yield down the credit curve. Getting rated, even badly, changes who is allowed to consider you. One caution on reach: Moody’s rated the protocol as a counterparty. That does not by itself make USDS, or any vault built on top of it, eligible under a particular mandate. It gets the name into the review process. That is the real headline here, more than the number itself.

The Risks a Credit Rating Does Not Certify

Rating agencies built their models on decades of corporate balance sheets, loan books, and sovereign budgets. They are now applying that machinery to protocols whose failure modes look nothing like a missed coupon payment. The Drift exploit in April wiped out $295.4 million in verified losses, and the recovery pool that finally opened this month started with just $3.11 million. More is pledged, including up to $127.5 million from Tether, but a pledge is not cash in the pool.

The recovery pool opened with just $3.11 million, putting immediate redemptions at roughly 1 cent on the dollar.

That is not a credit event in the traditional sense. It was not even a bug in the code: attackers talked Drift’s own signers into pre-approving transactions that handed over control of the protocol. This same week brought news that Ledger confirmed a hardware implant in a customer’s hardware wallet, in what looks like a supply chain attack through a reseller, and that the XRP Ledger patched a decade-old bug that could have minted billions of dollars of XRP from nothing. None of that shows up on a balance sheet. A credit rating is an opinion about capacity to pay. It does not certify the code, the keys, or the people guarding the reserves against being tricked, exploited, or physically tampered with, and it does not promise you get your money back after a hack.

S&P’s vault framework is built with exactly these failures in mind. It scores six risks: portfolio credit quality, liquidity mismatch, the curator, the blockchain, the protocol, and vault security and governance. S&P says outright that a vault assessment is not a credit rating and does not comment on yield. No vault has been graded yet; the first assessments come later. But the market will not read it that carefully. The moment a vault or a stablecoin carries a familiar alphanumeric grade, retail platforms will market it as safety, and institutional allocators will be tempted to treat it as a mandate-clearing checkbox, which a vault assessment is not. That gap, between what a grade measures and what people assume it measures, is exactly how structured credit earned its reputation during the last financial crisis. Nobody is saying DeFi vaults are mortgage-backed securities. The warning is narrower: the same agency’s name on two products does not mean the same protection. A credit rating like Sky’s speaks to capacity to pay. A vault assessment speaks to the chance a position gets impaired. Neither is a guarantee against the dozen other ways a blockchain product can lose your money.

What This Means for You

If you see a stablecoin or a lending vault carrying an S&P or Moody’s label over the next year, read past the letter grade. Ask what was actually rated: the reserve composition, the issuer’s legal structure, the smart contract code, or some combination, and whether the label is a credit rating at all. A B3 on a stablecoin protocol is not a verdict on whether you’ll get your money back after a hack. It is an opinion on whether the protocol can meet its obligations. Those are different questions, and the familiar letters will tempt people to treat them as one.

What’s Next

Watch whether Tether or Circle, the two largest stablecoin issuers, seek a formal issuer credit rating like Sky’s or keep relying on their own attestations and S&P’s narrower stablecoin stability assessments. That choice will not tell you on its own how confident they are in what a rater would find, but it will tell you whether the largest issuers think the permission slip is worth the scrutiny. Watch whether institutional inflows into assessed vaults outpace unassessed ones over the next two quarters, which would be evidence that the permission-slip effect is real rather than theoretical. And watch how fast Moody’s or S&P can move if a rated protocol gets hacked. Legacy ratings run on periodic review cycles. DeFi breaks on a Tuesday afternoon. Whether these agencies can rate at blockchain speed, or are about to find out they can’t, is the test that actually matters.

Presented by The Bridge. Weekly institutional research on blockchain, agentics, and tokenization, written for hedge funds, asset managers, and corporates. Because you read OMNM, the retail edition is yours for $349 (normally $399): thebridgenewsletter.com/signup?ref=omnm. OMNM co-host Douglas Borthwick co-founded The Bridge with Steve Kraus; we may earn a commission.