A new report from vaults.fyi shows that curated DeFi vaults now hold $11.29 billion in total value locked, but the market is becoming increasingly concentrated: the top five curators manage 69.3% of that capital. The survey mapped 856 vaults, 131 curators and 18 protocols as of August 20. Morpho has emerged as the dominant venue, holding about 46.2% of all curated capital across Ethereum-based chains and Solana.
The report highlights that spreading deposits across multiple vaults may not reduce risk if one curator team controls them. Curated vaults have expanded to 12.51% of supply-side DeFi TVL over the past year, up from 5.24%, even as the broader supply-side market contracted by 41.8%. The top five includes Sentora and Concrete, which were not ranked a year ago, while Usual fell from fourth to thirty-fourth. A separate DeFiLlama study using 55 tracked curators found the top three curators were Steakhouse Financial with $2.03 billion, Sentora with $1.97 billion and Gauntlet with $1.46 billion.
Institutional interest is growing alongside the concentration. Bitwise Asset Management has partnered with Morpho to launch non-custodial vaults, with the first product targeting a 6% yearly return. Bitwise predicts onchain vaults, which it calls “ETFs 2.0,” will double assets under management in 2026. Apollo has begun work with Securitize, Midas has teamed up with Fasanara, and JPMorganChase is launching tokenized money-market fund vaults. Across the 25 largest Morpho stablecoin vaults holding $3.71 billion, bitcoin backs 54.1% of lending, meaning depositors in stablecoin positions may indirectly carry bitcoin liquidity and liquidation risk.
In a separate incident, Term Finance permanently closed its Meta Vaults and revoked DAO governance roles after a governance exploit drained an estimated $8.5 million. Blockchain security firm PeckShield traced roughly 2,843 ETH (about $6.87 million) and 1.68 million USDC from affected vaults; the USDC was swapped for approximately 1.68 million DAI. The attacker reportedly funded the wallet with 2 ETH through Tornado Cash.
Term Labs said the shutdown is irreversible and prevents new deposits, while withdrawals remain open. However, the team has not confirmed depositor repayments, recovery amounts or a compensation timeline. The exploit targeted a custom governance wrapper built around Yearn V3 vault architecture, not standard Yearn V3 vaults, according to Yearn. An attack analysis found the attacker spent about $951 to obtain enough governance tokens to control four USDC strategy vaults and roughly 91% of the Ethereum Meta Vault.
The incident follows a broader pattern of governance attacks. In July, an attacker used purchased voting power to transfer about $20 million in BONK from BonkDAO’s treasury. ENS DAO later activated a security council, and Binance said it helped stop a malicious proposal threatening about $1.2 million in August. TRM Labs recorded 207 DeFi exploit incidents in the first half of 2026, more than double the 83 incidents from the same period in 2025.
