S&P Global Ratings has launched a risk barometer for digital-asset lending vaults similar to its letter-based credit ratings, tapping the growing spread of decentralized  finance products.

Adding to its suite of digital-asset tools--including  stablecoin  stability assessment --S&P has moved into the nascent but growing vault area. As of September, deposits totaled around $10 billion, up from $1.5 billion in September 2024.

Digital vaults work like managed funds that operate on a blockchain, pooling investor deposits and deploying them under defined strategies that can be automated via smart contracts or managed discretionarily by professionals.

S&P's new tool looks at elements like underlying assets, protocol, blockchain and curator capacity to gauge the risk of impairment to an investor's position in a lending vault. A rating of AAA(v), for example, would mean a vault's portfolio has extremely low credit risk, implying a very low likelihood of impairment even in stressed market conditions.

The move by one of the Big Three ratings companies underscores that as institutional investors gradually embrace decentralized  finance, widely known as defi, the nature of investing risk is evolving.

A key thing to understand is that the vault area is permissionless, said Andrew O'Neill, managing director and analytical lead on digital assets at S&P.

"Anyone can go and create their vault. That doesn't mean you're going to attract assets, but anyone can do it," he said in an interview.

That low entry barrier creates a need to arm investors with the ability to differentiate between low, medium and high risk.

"There's a huge amount of transparency that's available when information is on a blockchain," O'Neill said. But information being available, and being digested and understood are two different things.

One issue is that risk assessment needs to happen in real time.

When risk emerges on a blockchain, it is observable live, he said. It "becomes a kind of real-time monitoring exercise."

That is a departure from traditional funds, where monitors receive reports periodically to process, triage and review.

"We've needed to set up on-chain pipes to have data available to us in real time and to be able to alert our analysts," said O'Neill.

As artificial intelligence advances, attacks on digital-asset infrastructure are becoming more sophisticated.

TRM Labs analysis shows that AI-powered attacks are increasingly targeting infrastructure. In August, one attack depleted roughly 68% of a vault product's value.

Cyberattacks are particularly relevant in the vault sector because it is new, said O'Neill. The largest vaults emerged only a couple of months ago on Robinhood's new blockchain.

For more established, robust chains, the odds of a hack are more remote, he added. Some vaults have established crypto collateral backing loans and are fairly well battle-tested, but there are many newer untried assets too, O'Neill said. Such vaults can look nearly identical.

And with more fintechs entering the digital-vault sector, user numbers seem set to rise rapidly, "so you might see growth in areas that are maybe less battle-tested," O'Neill added.

So far, vault performance has been fairly resilient.

"Where we have seen losses occur, it has been because of generally a hack on an underlying asset that was eligible as collateral," he said. There are vulnerabilities around smart contracts too, namely around how secure their setup is in avoiding a malevolent takeover.

Asked what area of digital risk S&P might look at next, O'Neill said he likely has his hands full for now.

"I think this vaulting is going to keep us pretty busy, to be honest," he said. Not just because of what already exists but because it is a very fast-moving area, "and we can't necessarily predict what the next vault is going to look like."