Insights from $20B Risk-Assessed DeFi Vault Issuers

Risky vault with the big APY is not the worst trade to make. Instead, it's a risky vault that pays you almost nothing: low yield, high risk, maximum danger for minimum compensation. Trading Strategy ran their vault universe through CORE3's Probability of Loss (PoL), the risk index of the project issuing each vault. The combined risk-and-reward picture shows that the trade everyone assumes they're making, more risk for more return, mostly isn't on the menu.

About $25.8B of stablecoin vault capital was eligible for scoring.

PoL ranges from 0 to 100; lower is better, and it scores the issuing project. When pairing each band with the value locked in vaults from issuers in it, the picture looks like this:

98.3% of all scored assets is concentrated in the two safest bands (PoL 0-40), and only $332M, 1.3% of covered capital, is locked behind issuers riskier than PoL 40. Above PoL 80, the danger zone holds essentially nothing on Trading Strategy.

The data says no, and in places it says the opposite. Pair the same bands with the 3-month annualized returns of the vaults behind those issuers, and the supposed risk-reward curve flattens and in places inverts:

The biggest allocation share earns the least. The two largest clusters, Sky's $5.9B vault behind a PoL 13 issuer and the $8.0B Morpho/Hyperliquid cluster behind a PoL 22 issuer, receive 3.7% and 4.1% APY. Over $14B of capital is staked behind low-risk issuers for low reward. 

The high returns are tiny in volume. Those double-digit clusters (11.8% behind a PoL 24.9 issuer, 11.7% behind a PoL 36 issuer) hold only $69M and $104M. Good-yield-from-moderate-risk-issuers vaults are also included in the set, and almost no volume is locked in this segment. Combined, all clusters with yield paying over 10% hold less than $175M.

There is no risk-premium curve. If "more issuer risk means more reward" held, returns would increase as you move down the table, but they flatten instead. Highest-return clusters scatter across issuer PoL 24 to 36, while the riskiest populated band, 60-80, receive rewards of a flat 0-4%. Taking on a riskier issuer is currently paying you nothing on Trading Strategy.

A fifth of the market is not risk-assessed yet. $5.6B, 21.7% of eligible TVL, is unscored. Its risk-and-reward position is unknown.

The best risk-adjusted positions are a small group of vaults that pay double-digit yields while carrying only moderate issuer risk, roughly the same risk level the market is currently accepting low single-digit yields for elsewhere.

To read the figures below: PoL (Probability of Loss) is an issuer-risk score where lower is safer. TVL (Total Value Locked) is the amount of capital deposited. The return shown is the trailing three-month yield, annualized.

Two standout positions:

First, a cluster of 19 vaults at a PoL score of 24 and 12.3% APY. It holds $62.9M in total, with the largest positions being Alpha USDC Delta V2 (Morpho) at $22.2M, Api3 dCOMP USDC (Morpho) at $8.1M, and Alpha USDC Asia V2 (Morpho) at $7.7M. Its significance is that the issuer risk is nearly identical to a much larger $8.2B cluster that pays only 4.0%, yet this group pays ~three times the yield.

Second, a cluster at a PoL score of 36.0, paying 11.7%, holding approximately $104M. This is the second pocket of double-digit yield available at moderate risk.

For context, the largest default position is Sky's USDS vault: $5.9B in TVL at a PoL score of 13, paying 3.7%. This is the lowest-risk option available and is priced accordingly. It is appropriate for capital preservation rather than yield generation.

Why these positions stand out: across the broader market, yield does not increase as risk increases beyond a PoL score of 40. In other words, taking on more issuer risk above that level does not earn a higher return. The opportunity is therefore concentrated in these specific moderate-risk clusters rather than spread evenly across the risk spectrum. The PoL 24.4 and 36.0 clusters are notable precisely because they offer double-digit yield without a meaningful increase in risk.

One important qualification: these clusters are small, averaging only a few million dollars per vault. As a result, deploying significant capital into them may compress the yield, and the ability to exit quickly during market stress is a genuine consideration that the risk score alone does not capture. The figures should be treated as directional rather than as evidence of capacity to absorb large allocations.

PoL scores the project that issues a vault, not the vault. That distinction decides how far you can push the numbers above.

PoL was built to evaluate a project holistically, across 80+ metrics spanning Security, Financial, Operational, Reputational, Compliance, and Dependency risk. Vaults fall inside that scope, so vault-related risks do feed the project score. What the framework cannot do is weight how much one specific vault matters inside the broader project structure. A project running one vault and a project running forty can share a PoL, while the per-vault exposure behind that number is completely different. The assessment is not granular enough to give a definitive answer on any individual vault.

Instead, a focused vault-level model gives you high confidence on the vault. While a project model gives you high confidence on the issuer. 

So read this dataset for what it is. A project PoL is an effective high-level filter and useful context on the entity behind a vault, the team you are trusting to run it. It is not a substitute for a dedicated vault-specific assessment, and a low issuer PoL does not certify the vault sitting underneath it.

In traditional finance, the idea that higher reward requires higher risk is treated as a basic law. It holds reasonably well in large, mature markets, because when a position offers more return than its risk justifies, capital floods in and competes the excess away. That mechanism depends on a market being deep, liquid, and closely watched. On-chain stablecoin vaults are none of those things yet. They are younger, thinner, and priced by far fewer participants, so the arbitrage that would normally enforce the risk-reward relationship simply has not happened. The practical consequence is that vault yield and issuer risk have come apart and now behave as two separate measures rather than two sides of the same coin.

Roughly $20B is locked behind low-risk issuers in vaults paying under about 4%, while every vault paying over 10% holds less than $175M combined. Read those two figures together and the conclusion is unavoidable: the market is not paying a meaningful premium for taking on more issuer risk. Above a certain point, the reward for trusting a riskier issuer is flat, and in places negative. This is not how an efficiently priced market behaves. It is what a market looks like before its participants have collectively decided what risk is worth, and that gap is precisely where a careful allocator can find positions the broader market has not yet priced correctly.

That gap will not stay open forever, which is the part worth thinking through. The current inefficiency exists because capital has prioritized safety and familiarity over yield, concentrating in a handful of large, recognizable vaults. As the market matures and more allocators run the same risk-adjusted analysis, money should begin moving toward the underpriced moderate-risk positions, and their yields should compress toward the rest of the market. An allocator acting now is being compensated partly for the analysis itself and partly for being early, before that repricing occurs. The flip side is that being early also means accepting the thinner liquidity and shorter track records that are the very reasons these positions remain underpriced. The opportunity and the risk share the same root cause.

The discipline this calls for is straightforward to state and harder to apply: read the issuer risk first, then the vault yield, and treat the issuer score as a filter rather than a final verdict on any individual vault.