What Happened in April: KelpDAO, Aave, and the $12 Billion TVL Drop
On April 18, 2026, an attacker minted 116,500 unbacked rsETH tokens via a misconfigured LayerZero bridge on KelpDAO's cross-chain system. The attacker deposited the forged rsETH as collateral on Aave V3 and V4, borrowing approximately $236 million in WETH. Within hours, Aave froze every rsETH market and urged WETH suppliers to withdraw liquidity.
Aave's TVL dropped from $48.5 billion to $30.7 billion in a single day as depositors rushed to pull funds. The AAVE token fell 18%. The bad debt — roughly $196 million by most estimates — sat on Aave's balance sheet while governance debated whether the Umbrella safety module had sufficient reserves to cover it.
Morpho, by contrast, reported exposure of approximately $1 million across two isolated lending markets. Other Morpho vaults were entirely unaffected. The isolated market architecture — where each curator-managed vault allocates to specific collateral/loan pairs with independent risk parameters — prevented the KelpDAO bad debt from cascading across the platform.
Between April 18 and May 1, Morpho's Ethereum mainnet TVL grew from approximately $4.2 billion to over $5.8 billion, as institutional allocators and DeFi treasuries rotated capital away from shared-pool lending models and into the curator-managed isolation structure.
This is the structural validation the curator model needed. It's also the reason stablecoin yields on Morpho vaults now serve as the risk-adjusted benchmark for institutional DeFi allocators in 2026.
The Curator Model: Why Institutions Trust Veda, Gauntlet, and Steakhouse
A Morpho vault curator is not a fund manager. The curator does not have custody of deposited assets. The curator cannot move funds to an unauthorized protocol, because the vault's smart contract rejects transactions outside its whitelist.
What the curator does: selects which isolated lending markets the vault allocates capital to, sets supply caps and loan-to-value ratios for each market, monitors collateral quality, and rebalances allocations in response to changing risk conditions.
When a curator proposes adding a new market or raising a supply cap, the vault enforces a timelock. During that window, any depositor can withdraw. A guardian address (typically controlled by Morpho governance or a third-party risk committee) can veto the change. The contracts are immutable. The curator's role is parameter selection and monitoring, not execution.
The three largest curators on Morpho in May 2026 are Gauntlet, Steakhouse Financial, and RE7 Labs. Combined, these three firms manage approximately $3.2 billion of Morpho's $5.8 billion TVL.
Gauntlet operates the largest USDC vault on Morpho, with approximately $1.4 billion in deposits. Gauntlet's model is conservative: allocate to lending markets backed by wstETH, WBTC, and other Tier 1 collateral, enforce strict loan-to-value caps (typically 70-80% for liquid staking tokens, 75-85% for WBTC), and rebalance daily based on on-chain utilization data. The vault targets 4-6% APY for USDC depositors, sourced from organic borrowing demand.
Steakhouse Financial manages approximately $900 million across multiple Morpho vaults, including a Base-native USDC vault targeting 5-7% APY. Steakhouse's edge is institutional reporting: weekly performance dashboards, quarterly risk audits, and direct integration with centralized exchanges (Kraken's DeFi Earn product routes deposits into Steakhouse-curated Morpho vaults). The firm is a recognized DeFi risk management specialist with a track record of conservative vault curation.
RE7 Labs operates a more aggressive vault strategy, targeting 7-9% APY by allocating to newer collateral types (including tokenized real-world assets and restaked ETH derivatives). RE7's vault has approximately $800 million in TVL, but the higher yield comes with tail risk — exposure to collateral types that have not been battle-tested through a full market cycle.
For institutions prioritizing capital preservation, Gauntlet and Steakhouse are the default choices. For treasuries willing to take incremental risk for 200-300 basis points of additional yield, RE7 is the growth option.
How Isolated Markets Prevented Contagion (And Why Aave's Model Failed)
Aave and Compound use shared liquidity pools. When you deposit USDC into Aave, your capital sits in a single pool alongside every other USDC depositor. Borrowers post collateral (ETH, wstETH, WBTC, etc.) and draw from the shared pool. If one borrower defaults and the collateral value falls below the loan amount, the bad debt is socialized across all depositors in that pool.
This is why the KelpDAO exploit hit Aave so hard. The attacker used forged rsETH as collateral to borrow WETH from Aave's shared WETH pool. When Aave froze the rsETH markets, utilization rates spiked to 100%, and many depositors could not withdraw. The freeze was a protective measure, but it also meant capital was temporarily locked.
Morpho's architecture is different. Each lending market on Morpho Blue is isolated. A USDC/wstETH market (where USDC lenders supply capital to borrowers posting wstETH as collateral) is entirely separate from a USDC/WBTC market. Bad debt in one market does not propagate to others.
When KelpDAO's rsETH was used as collateral in a Morpho market, the exposure was limited to the two specific vaults that had allocated to rsETH/USDC or rsETH/USDT markets. The total loss was approximately $1 million. Every other Morpho vault — including the $1.4 billion Gauntlet USDC vault — had zero exposure, because their curators had not whitelisted rsETH as approved collateral.
This is not just a technical advantage. It's a governance advantage. On Aave, adding a new collateral type requires a governance vote that applies across the entire protocol. If Aave governance approves rsETH as collateral, every depositor is exposed to rsETH risk, whether they like it or not.
On Morpho, each curator decides independently which collateral their vault accepts. Gauntlet can reject rsETH while RE7 accepts it. Depositors self-select into the risk profile they want by choosing which curator to allocate to.
After the April exploit season, this model proved its structural superiority. Aave's TVL fell $12 billion. Morpho's TVL rose $1.6 billion.
Current USDC Vault Yields: Gauntlet, Steakhouse, and RE7 Compared
As of May 29, 2026, the three largest Morpho USDC vaults offer the following risk-adjusted yields:
Gauntlet USDC Vault (Morpho Ethereum Mainnet)
- TVL: ~$1.4 billion
- Current APY: 4.8%
- Collateral mix: 68% wstETH, 22% WBTC, 10% rETH
- Loan-to-value caps: 75% wstETH, 80% WBTC, 70% rETH
- Minimum deposit: 0.01 USDC (no gating)
- Curator fee: 10% of yield
- Net APY after fees: 4.3%
Steakhouse Financial USDC Vault (Morpho Base)
- TVL: ~$620 million
- Current APY: 5.6%
- Collateral mix: 55% cbETH, 30% USDC/wstETH LP tokens, 15% WBTC
- Loan-to-value caps: 78% cbETH, 70% LP tokens, 80% WBTC
- Minimum deposit: 0.01 USDC
- Curator fee: 12% of yield
- Net APY after fees: 4.9%
RE7 Labs USDC Vault (Morpho Ethereum Mainnet)
- TVL: ~$800 million
- Current APY: 8.2%
- Collateral mix: 40% wstETH, 25% tokenized Treasuries (OUSG, USTB), 20% restaked ETH derivatives (not rsETH), 15% WBTC
- Loan-to-value caps: 75% wstETH, 65% tokenized Treasuries, 60% restaking derivatives, 80% WBTC
- Minimum deposit: 1,000 USDC (soft gating via UI)
- Curator fee: 15% of yield
- Net APY after fees: 7.0%
The yield differential is real. RE7's 7.0% net APY is 270 basis points higher than Gauntlet's 4.3%. That premium compensates for exposure to tokenized real-world assets and restaking derivatives — collateral types that have shorter track records and less battle-tested liquidation infrastructure.
For context, sustainable stablecoin yields from organic DeFi borrowing demand typically range from 4-8% APY in 2026. Returns above 8% often involve platform incentives, token subsidies, or leverage — all of which add tail risk.
Gauntlet and Steakhouse target the 4-6% band. RE7 stretches into the 7-9% band by accepting newer collateral types. Both approaches are rational. The risk-adjusted return depends on your capital base and time horizon.
For a side-by-side comparison of all major stablecoin yield strategies in 2026, including Aave, Sky, and Pendle fixed-rate products, see the RWTS Stablecoin Yield Hub.
What the May Exploit Season Means for DeFi Vault Safety
Between May 15 and May 19, 2026, three DeFi protocols — THORChain, Verus Bridge, and Echo Protocol — were exploited for a combined $98 million. That's the highest single-week exploit volume of the year, exceeding total monthly losses from Q1 2026 combined.
The mechanics across all three attacks were similar: a single compromised admin key enabled unbounded minting or unauthorized withdrawals. The protocols Kraken is now routing customer bitcoin into for its new BTC yield product — Aave, Morpho, and Tydro — have not been immune to this year's security crisis, though Morpho's isolated design limited its exposure.
The structural lesson: curated vaults with independent risk management outperformed monolithic lending pools. Morpho absorbed the Aave rotation without a bank run because its isolated markets prevented contagion. Aave's shared liquidity model meant one bad collateral decision (approving rsETH with high LTV) cascaded across the entire platform.
For institutions allocating capital in 2026, the curator model is now the baseline. Shared-pool lending (Aave, Compound) still dominates by total TVL, but the growth vector is curated isolation (Morpho, Kamino on Solana).
The Federal Reserve held rates at 3.5-3.75% at its April 29, 2026 meeting, with Chair Jerome Powell signaling no urgency to cut despite elevated PCE inflation at 2.8%. That macro backdrop keeps DeFi stablecoin yields structurally attractive versus cash equivalents, even after accounting for smart contract risk.
For the RWTS Methodology on how we score DeFi lending protocols and vault curators, see the Trust Score framework. For asset-specific yield strategies on USDC, USDT, and DAI, see the corresponding asset pages.
DeFi vaults are infrastructure, not speculation. The curator model proved its resilience in April 2026. The yields are sustainable because the demand is real — borrowers posting wstETH, WBTC, and tokenized Treasuries as collateral to access leverage or working capital.
Morpho is not the only game in town, but it's the architecture that survived the stress test. The Trust Score reflects that.
