TL;DR
Nothing about the Morpho Blue core got worse this month, one thing got measurably better, and the on-chain verification is firmer than we have managed before. We did not carry August forward. We re-read the core at today's block and at the exact block we read in August, and diffed them. The deployed bytecode is byte-identical, 15,623 bytes with a matching hash. owner() returns the governance Safe at both blocks. Both EIP-1967 slots read zero, so there is no proxy behind it. The Safe answers threshold 5, nine owners, VERSION 1.3.0, and the nine owner addresses are the same nine as in August, confirmed against three independent archive providers. Its nonce is 281 at both blocks, meaning it has executed no transaction at all since 2026-08-11, it has zero modules enabled and no transaction guard set. There is no path by which that owner set changed and we did not see it. The audits page now carries Morpho Midnight, which closes the one caveat we left open in August. TVL is $10,731,323,774, an all-time high, up 20.1 percent in 30 days and 57.3 percent in 90.
The month also produced a new incident, and it belongs in the record even though it did not cost a lender anything. On 2026-08-25, between 04:28 and 04:37 UTC, one wallet ran eleven trades converting roughly $320,000 of SY-reUSD into more than 9.5 million YT-reUSD. Pendle's PT and YT move like a seesaw, so bidding YT up lifted the implied yield from about 11 percent to over 20 percent and repriced PT-reUSD down about 3 percent. The oracle used by the Morpho markets holding PT-reUSD as collateral takes the lower of a 15-minute market average and a fixed discount curve, so it followed the market down, and leveraged loop positions with almost no headroom went under. Thirty-three liquidation events between 04:37:47 and 04:51:23 UTC repaid $36.14 million of debt, $35.19 million in the USDC market and about $956,000 in the USDT market, across roughly 19 to 20 borrower positions. The markets ran at a 91.5 percent LLTV. Steakhouse Financial, which deployed the market, said lenders in its vaults were unaffected and no bad debt was created. Re, the issuer of reUSD, said the same of the market. Pendle said the feed was configured correctly and did what it was designed to do, and that it is reviewing its oracle configurations. Morpho itself published nothing. MORPHO fell about 12 percent that day.
The verdict stays solid, and the honest version of why is short. This is the sixth incident above the core in under two years, and the case for grading Oracle red is the same case the August research pass made and doxe rejected: at Euler the protocol's own curated vaults broke, whereas here the market, the curator and the oracle are all the depositor's pick. August 25 does not give that argument new ground. If anything it lands on the weaker side of it, because the people who lost money were borrowers who chose a 91.5 percent LLTV loop on a long-tail principal token, not depositors who parked stablecoins. The core stayed adminless, governance did not move a single transaction, and no vault took bad debt. We are not overturning a curator call on facts the curator already weighed.
Checklist
Audits & contracts. The strongest dimension and the reason this verdict survives everything else in the report. We re-pulled the registry today. Spearbit covers Morpho Midnight, Vault V2, the Vault V2 adapters registry, preliquidation, the public allocator, Morpho Blue, Vault V1 and Vault V1.1. OpenZeppelin covers Blue, Vault V1 and Vault V1.1. Certora covers the Vault V2 adapter and registry work on that page, and the formal-verification specs for the core are still committed in the morpho-blue repository under certora/, which we checked on main today. ChainSecurity and Zellic cover Vault V2, Blackthorn covers Midnight and Vault V2, ABDK covers preliquidation, Trust Security and StErMi cover Midnight, and Cantina ran competitions on Midnight, Vault V2, Blue and Vault V1 with periphery. Omniscia audited the token, Lexfo the DNS and GitHub infrastructure, Securing the frontend.
August left one thing open: Midnight went live in July 2026 with no audit listed on Morpho's own page, and we refused to repeat a security claim we could not find at the source. The page now carries seven Midnight entries, from Spearbit, Blackthorn, Trust Security, StErMi and a Cantina competition. We are recording that as closed, with one correction to how the draft of this report framed it. Every Midnight entry is dated between 2026-04-07 and 2026-07-02, which is before our August pull. So the change is not that new audits happened. Either Morpho published existing reports to the registry after 2026-08-11, or our August read of that page simply missed them. We cannot distinguish those two from here, and the second would be our failure rather than Morpho's. Markets V2 still has no entry on that page: refresh.
Admin control. Verified by diff, not by quotation, and this is where the draft of this report undersold what is checkable. The Morpho Blue core at 0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb returns 0xcBa28b38103307Ec8dA98377ffF9816C164f9AFa from owner() both today and at block 25,731,436, the block we read in August. Its deployed bytecode is byte-for-byte the same at both blocks. Both EIP-1967 slots, implementation and admin, read zero. The Safe answers getThreshold 5, getOwners with nine entries, VERSION 1.3.0, and the nine addresses at block 25,731,436 are identical to the nine today on three independent archive endpoints. The Safe's nonce is 281 at both blocks, so it has executed nothing in between, it has no modules enabled and no guard configured, which closes the only two routes by which owners could change without incrementing that nonce.
The draft left signer rotation as unverifiable because it tried to answer the question with an event-log scan and every free RPC refused the block range. That was the wrong tool. A historical eth_call needs no log range and settles it outright. We are recording the method because the draft's first attempt at the log scan returned a clean "no changes" from chunks that had all errored, and a green answer from a broken query is how you publish a lie.
What the owner can do is unchanged: a fee switch capped at a quarter of borrower interest, whitelisting LLTV tiers and interest-rate models for future markets, treasury, token and ENS. It cannot touch a live market's LLTV or oracle, and because the core is immutable that ceiling is not a policy, it is arithmetic in deployed code.
The yellow here is still the curator. Whoever runs your vault picks the markets, sets the caps, appoints allocators and takes a fee. That is an admin over your principal by any ordinary meaning of the word, and it is the layer where every loss on this protocol has happened. SEC Commissioner Hester Peirce's July statement on vaults where humans exercise discretion remains the live regulatory question, with no rule, order or action against Morpho and nothing new in this window.
Oracle. The oracle is chosen per market by the market creator, never by the protocol, so the quality of yours is a property of your market rather than of Morpho. That surface has now produced six documented events, three of them squarely oracle failures and each of a different kind: a decimals misconfiguration in October 2024 that priced gold near $2.6 trillion an ounce and cost about $230K, a Pyth cbETH feed frozen for seven minutes in March 2025 that wrongly liquidated 14 ETH, and a hardcoded wstUSR feed in March 2026 that carried collapsed collateral at $1.13 while it traded near $0.63, with 15 vaults exposed and about $180M of liquidations tied to Morpho positions.
August 25 is the fourth flavor and the most interesting one, because nothing was misconfigured. The PT-reUSD feed took the lower of a 15-minute average and a roughly 6 percent annual discount curve, which is a sane design, and the collateral genuinely did trade about 3 percent lower for a few minutes. The problem was that the YT side of that Pendle pool, the December 10 reUSD pool, held only about $8.97 million, so $320,000 of buying could move the implied yield from roughly 11 percent to over 20 percent and drag PT with it. Put a 91.5 percent LLTV on top of that and the safety buffer is thin by construction: Steakhouse itself flagged positions with health factors under 1.03 as vulnerable, and reporting puts the affected borrowers under 3 percent of protection. The market carried about $67.5 million of PT collateral against about $52.2 million of borrows. Nobody needed to break the oracle. They just needed the market to be small and the loop to be tight.
One thing worth naming rather than leaving generic: reUSD is issued by Re, which sits on our own watchlist at risk tier 3 with a caution verdict and a red on liquidity and exit as of our 2026-07-20 report. The collateral in the market that blew up was an asset we already grade as thin on the way out.
We are holding this at yellow, and we want the coupling visible: that is the single grade keeping the headline at solid, because a red here on a fund-loss surface would force caution under the gate. The reasoning is doxe's from 2026-08-11 and it is unchanged. At Euler the broken vaults were the protocol's own flagship. Here the depositor picks the market, the curator and the oracle, and the core cannot alter any of them once the market exists. A reader who disagrees with that distinction should read this dimension as red and the verdict as caution, and the facts above are the same either way.
Liquidity & exit. Unchanged in shape, and this run we put a number on it. There is no protocol-level exit guarantee. You are withdrawing from your market's shared liquidity, so full utilization means you wait for repayment, fresh supply, or the rate curve to do its job. November 2025 showed the full sequence: idle cash first, utilization at 100 percent, withdrawals queued, borrow rates ramping toward 190 percent to force repayment or liquidation. Morpho put it at 3 to 4 of about 320 vaults affected, press reporting said dozens, and we never settled which.
What we could settle is how much of today's book could actually leave. Across the top 200 Vault V2 vaults, which is $4.749 billion of a $4.751 billion book, instant liquidity is $1.536 billion, or 32.4 percent, and only $500 million of that is idle cash. The largest vault on the protocol, Steakhouse USDG at $486 million, is 7.6 percent liquid. Two thirds of the V2 book is lent out at any moment, which is what a working lending protocol looks like and also what a queue looks like when everyone leaves at once.
We also have to correct the draft on in-kind redemption. It is not a September ship reported by press. It is a documented Vault V2 mechanic in Morpho's own docs: flash-loan the underlying, deposit it, call forceDeallocate, repay the flash loan and walk away holding a direct position in the underlying market. That is genuinely useful and it is live by design rather than pending. It is also not cash. It converts "wait in a queue" into "hold an illiquid market position yourself", which helps a sophisticated borrower and does very little for a retail depositor who wanted stablecoins back. Force-deallocatable capacity across those 200 vaults is $524 million, 11.0 percent of the book.
Yield: real vs emission. Real. Supply yield is borrower-paid interest, MORPHO incentives sit on top of it rather than in place of it, and outstanding loans hit a reported record of $5B on 2026-09-01, of which press puts 95 percent in stablecoins and 62 percent in USDC. DefiLlama shows $5.168B borrowed against the $10.73B TVL today, which is consistent.
August 25 is the practical footnote. The positions that died were not earning a lending rate, they were earning a loop: deposit PT, borrow USDC, buy more PT, repeat, with under 3 percent of headroom by press accounts and roughly 53 basis points by one X analyst's read. When a vault or a front end advertises a yield far above what overcollateralized lending pays, the difference is almost always leverage or a subsidy, and leverage is the part that gets liquidated on a 3 percent move. The August report flagged an 18 percent USDC vault APY at Bitget whose composition we never checked. That is still refresh, and the question behind it is the same.
Holder concentration. Token side re-pulled today: MORPHO trades at $2.58, market cap $1.807B, fully diluted $2.585B, with 698,882,077 of 1,000,000,000 circulating, or 69.89 percent, up 10.8 percent over 30 days. In August that was 656,183,635 and 65.62 percent, so roughly 42.7 million tokens unlocked in six weeks and the schedule is grinding forward toward 2029. The allocation itself, DAO 35.4 percent, strategic partners 27.5, founders 15.2, Association reserve 6.3, is carried from August and we did not re-pull it this run. It is sell pressure and governance weight, not a claim on deposits.
The concentration that reaches deposits is at the vault layer, and it has changed shape a lot in six weeks. We measured it fresh through Morpho's own GraphQL, as in August, because DefiLlama published a 3.5x error on a vault we checked on chain in the past. Vault V1 now holds $2.023B across 843 vaults with assets out of 1,399 that exist, with Gauntlet USDC Prime on Base the largest at $419.8M, 20.8 percent of that book, and the top ten at 78.3 percent. Vault V2 holds $4.751B across 3,388 vaults, which we enumerated in full rather than sampling: the 2,388 vaults below the top thousand hold $1,081 between them, so the tail really is immaterial. Steakhouse USDG on Robinhood Chain is the largest single vault anywhere at $486.0M, Paypal USD Main at $436.1M behind it, the top ten at 63.4 percent. Steakhouse-branded vaults alone are 41.8 percent of the V2 book across 155 vaults, and Sentora-branded a further 19.2 percent, so two curator brands hold three fifths of it. That Steakhouse figure is the closest anything has come to reproducing the press claim we could not verify in August, that Steakhouse holds more than half of Morpho's USDC deposits. Note that V1 and V2 cannot simply be added, because a V2 vault can allocate into a V1 vault through an adapter and we would be counting the same dollar twice. The deduplicated total is refresh.
Track record. Two and a half years, now $10.73B, and the core contract has never been the point of failure. The April 2026 KelpDAO rsETH exploit is still the cleanest evidence for the design, with Morpho's exposure around $1M across two isolated markets while Aave's own incident report modeled roughly $123.7M of bad debt under uniform socialization.
The list above the core is now six entries. October 2024, PAXG decimals, about $230K, which DefiLlama logs at $250K. March 2025, a frozen Pyth cbETH feed, 14 ETH in an Re7 vault. July 2025, the Kinto proxy exploit, 577 ETH out of a Morpho lending vault and a Uniswap v4 pool. November 2025, Elixir sdeUSD, nearly 3.6 percent of an MEV Capital USDC vault's TVL. March 2026, Resolv wstUSR, 15 vaults. And now August 2026, PT-reUSD, about $36.4M liquidated with lenders whole. Four of those cost lenders or vault depositors principal. Two cost borrowers, liquidated on a feed that moved for reasons that had little to do with the health of their collateral.
Two days after the PT-reUSD cascade, on 2026-08-27, Moonwell was exploited for $8.7M on its own Base deployment when a thinly traded MAMO feed was pushed from about $0.0106 to $0.4313. That is not Morpho's contract and not Morpho's money, but Moonwell-named Morpho V1 vaults hold about $11.0M across seven vaults today, which we measured. Zyfai disabled the Moonwell-curated Morpho vaults as a precaution, said its agents had already rebalanced out before the incident escalated, and reported user funds safe. We did not independently verify that no loss reached them. DefiLlama's hacks list now records three Moonwell price-feed incidents in eleven months. It is worth keeping in view, because the curator brand on the vault is doing a lot of work in this protocol's risk model, and curator brands are not uniformly good at oracles.
Worst case
Unchanged in shape and now with two distinct versions, because August 25 demonstrated the second.
As a depositor, you are in a vault whose curator listed collateral priced by an oracle that stops telling the truth. The asset collapses, the feed holds it near par, borrowers draw against it at face value, liquidators cannot clear, and your shares absorb bad debt pro rata. The core keeps running and everyone in other markets loses nothing. November 2025 gives that a price, about 3.6 percent of one vault. March 2026 gives it a breadth, 15 vaults at once, and the curators caught were Gauntlet, Re7, MEV Capital and kpk, which is the professional tier rather than the fringe.
As a borrower, you are in a leveraged loop whose collateral is priced off a market thin enough that someone can move it for the cost of a used car. The feed reports the move honestly, your buffer is a fraction of a percent, and you are liquidated inside fifteen minutes while the underlying asset is fine. A liquidator takes the bonus. The two published figures for that take looked contradictory and probably are not: press describes Morpho's incentive formula producing roughly 2.6 percent at a 91.5 percent LLTV, which on $36.14 million of repaid debt implies about $940,000 of gross bonus and lines up with the roughly $921,000 X analysts counted, while the roughly $360,000 cryptotimes reported is described as realized gains. Gross versus realized, most likely. We did not confirm it.
There is no insurance fund behind either. Curator selection, oracle inspection and position sizing are the whole mitigation, and if you are looping, headroom is the fourth.
Bottom line
Solid, and held deliberately rather than by inertia. Everything we could verify on chain today came back the way the documentation describes it, and this run we could verify more than last time: the core is not merely described as immutable, its bytecode is the same bytes we read six weeks ago, and the governance Safe has not moved a single transaction since. The Midnight audit gap we flagged in August is closed on the registry. The protocol is at an all-time high of $10.73B, up 36 percent since we last wrote, with Ethereum at $5.01B, Base at $4.18B, Robinhood Chain at $553M after a 35 percent month, and Morph up more than fivefold from a small base. Outstanding loans set a $5B record on September 1. This is not a protocol in trouble.
The case for caution exists and we are not hiding it. Six incidents above the core, four of which cost depositors, on a surface that keeps failing in a new way each time: misconfiguration, staleness, a hardcoded price, and now an honest feed on a market too thin to defend. That case was made in August, weighed, and rejected on the ground that the depositor picks the market and the oracle while Euler's own flagship vaults were the ones that broke. August 25 does not strengthen it, because the loss landed on leveraged borrowers and the lenders were whole. If doxe wants Oracle at red, the facts supporting it are all in this report and the verdict follows mechanically to caution. What we will not do is smuggle that flip in as if this month provided it.
What to watch instead is the distribution. Vault V2 grew to $4.75B and the single biggest vault on the protocol is now a Steakhouse USDG vault on Robinhood Chain, with Paypal USD Main second. Steakhouse-branded vaults are 41.8 percent of that book and Sentora a further 19.2 percent. Consumer front ends are routing very large amounts of retail money into curated vaults chosen by a brand, not by an oracle review, and the concentration of that money into a handful of curators is rising rather than falling. Morpho is not one risk. The core is excellent, the vault is the decision, and the decision is increasingly being made for people who do not know they are making it.
Data appendix
- TVL: $10,731,323,774 (DeFiLlama,
morpho-blue, api.llama.fi/tvl/morpho-blue; the history series carries the same value at its 2026-09-19 point). This is the all-time high. Correcting the draft: this is not a first break above a year-old peak. The series has set new highs repeatedly since 2026-08-20, passing $8.68B on 08-20, $9.41B on 08-22, $9.82B on 09-04, $10.21B on 09-18 and $10.73B on 09-19. The $8,379,548,823 print of 2025-09-17 was the peak that stood until 2026-08-20, not the previous peak. 30d mark 2026-08-21 $8,931,612,501, up 20.1 percent. 90d mark 2026-06-22 $6,820,768,820, up 57.3 percent. Against our own 2026-08-11 report at $7,881,356,651, up 36.2 percent in 40 days. Borrowed $5,167,716,675, which is 48.2 percent of TVL. Chain split: Ethereum $5.01B, Base $4.18B, Robinhood Chain $553.0M (up 35.0 percent in 30d), Hyperliquid L1 $268.6M (down 19.9 percent), Monad $186.8M, Arc $185.1M, Morph $74.7M. Parent slugmorphoreads $10,735,703,401, which is the child plus about $4.4M of Midnight and legacy optimizer entries; the child is the right scope. Separately, Morpho's own headline metric is "total deposits", which press put at about $14.15B in early September. That is a different measure from DeFiLlama TVL and the two are not interchangeable; the press utilization figure of about 35 percent is $5B against $14.15B, while $5.168B against $10.73B is 48 percent. - Audits: Re-pulled from docs.morpho.org/learn/resources/audits this run, 32 entries. Spearbit (Midnight, Vault V2, adapters registry, preliquidation, public allocator, Morpho Blue, Vault V1, Vault V1.1), OpenZeppelin (Blue, Vault V1, Vault V1.1), Certora (Vault V2 adapter and registry; core formal-verification specs present in the morpho-blue repo under certora/ with confs, dispatch, helpers and specs subdirectories, checked on main today), ChainSecurity and Zellic (Vault V2), Blackthorn (Midnight, Vault V2, adapter), Trust Security and StErMi (Midnight), ABDK (preliquidation), Cantina competitions (Midnight, Vault V2, Blue, Vault V1 and periphery), Omniscia (token), Lexfo (infrastructure), Securing (frontend). Midnight carries seven entries dated 2026-04-07 to 2026-07-02, all of which predate our 2026-08-11 pull, so the change is in the registry's contents or in our August reading of it, not in new audit work. Markets V2 is not listed on that page: refresh.
- Admin/governance: Verified on chain today via drpc, nodies and mevblocker, latest block 26,014,612, and diffed against block 25,731,436, the block read on 2026-08-11. Morpho Blue 0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb: owner() returns 0xcBa28b38103307Ec8dA98377ffF9816C164f9AFa at both blocks; deployed bytecode is byte-identical at both blocks (15,623 bytes, identical SHA-256); EIP-1967 implementation and admin slots both read zero, so it is not an upgradeable proxy. Safe 0xcBa28b38103307Ec8dA98377ffF9816C164f9AFa: getThreshold() 5, getOwners() nine addresses, VERSION() 1.3.0, all identical at both blocks on three independent archive endpoints; nonce() 281 at both blocks, so zero Safe transactions executed in between; getModulesPaginated returns an empty array, so no module can bypass that nonce; the guard storage slot reads zero. This retires the draft's open item on signer rotation: the nine are the same nine. The draft could not answer it because it attempted an event-log scan that every free RPC refused on block range, where a historical eth_call needs no range at all. Owner powers unchanged: fee switch capped at 25 percent of borrower interest, LLTV and IRM whitelisting for new markets, treasury, token, ENS; no power over an existing market's LLTV or oracle.
- Oracle: Per market, chosen by the market creator, no protocol default. New this window, 2026-08-25: wallet 0x854e...690d ran 11 trades between 04:28 and 04:37 UTC converting about $320,000 of SY-reUSD into over 9.5 million YT-reUSD, lifting implied yield from about 11 percent to over 20 percent and pushing PT-reUSD down about 2.8 to 3 percent; the PT oracle, which takes the lower of a 15-minute average and a roughly 6 percent annual discount curve, followed. Thirty-three liquidation events between 04:37:47 and 04:51:23 UTC repaid $36.14M of debt ($35.19M USDC, about $956K USDT) across roughly 19 to 20 positions, commonly reported as about $36.4M liquidated. LLTV 91.5 percent across the USDC, USDT and AUSD markets, press-confirmed by three outlets rather than X-sourced, correcting the draft. The market was deployed by Steakhouse, also press-confirmed via Pendle's statement rather than left as an X attribution, and carried about $67.5M of PT collateral against about $52.2M of borrows. The Pendle December 10 reUSD pool held about $8.97M, also press-confirmed. Steakhouse Financial: lenders unaffected, no bad debt, and it flagged health factors under 1.03 as vulnerable. Re, the reUSD issuer: the Morpho market incurred no bad debt and reUSD itself was unaffected. Pendle: the feed was configured correctly and behaved as designed, and it is reviewing oracle configurations. Morpho itself published no statement, confirmed by an X-wide scan. Collateral seized is contested: 38.6 million principal tokens per cryptodaily, 11.7 million per cryptotimes. Liquidator take is contested and probably reconcilable: press describes a roughly 2.6 percent liquidation incentive at that LLTV, implying about $940K of gross bonus on $36.14M, close to the roughly $921K X analysts counted, against about $360K that cryptotimes describes as realized gains. The precise borrower buffer, roughly 53 basis points per one X analyst against "under 3 percent" in press, is refresh. Prior confirmed oracle losses stand unchanged: PAXG/USDC decimals 2024-10-13 (about $230K, logged by DeFiLlama's hacks list as $250K on 2024-10-14, its only Morpho entry in 1,273 records), Pyth cbETH desync Mar 2025 (14 ETH, Re7 vault), Resolv wstUSR 2026-03-22 (DeFiLlama logs the Resolv exploit at $24.5M on 2026-03-21; 15 of roughly 500 Morpho vaults with meaningful deposits exposed, about $180M of liquidations tied to Morpho positions). Morpho-specific bad debt from March 2026 remains unpublished: refresh. Oracle involvement in the November 2025 sdeUSD loss remains open: refresh.
- Liquidity: Measured this run across the top 200 Vault V2 vaults, $4,748,569,262 of the $4,750,950,520 book. Instant liquidity $1,536,164,762 (32.4 percent), of which idle assets $499,555,091 (10.5 percent). Force-deallocatable liquidity $523,991,104 (11.0 percent). Largest vault Steakhouse USDG: $486.0M assets, $37.0M liquid (7.6 percent), $17.4M force-deallocatable. In-kind redemption is documented in Morpho's own Vault V2 docs as forceDeallocate combined with a flash loan, with no ship date given and no indication it is new; it returns a position in the underlying market, not cash. The draft's framing of it as a September press-reported release is withdrawn.
- Holder concentration: MORPHO $2.58, market cap $1,806,800,478, FDV $2,585,272,304, circulating 698,882,077 of 1,000,000,000 (69.89 percent), ATH $4.17 on 2025-01-17, up 10.8 percent over 30 days (CoinGecko, data as of 2026-09-19T22:42Z). August read 656,183,635 and 65.62 percent, a release of about 42.7M tokens. Allocation split (DAO 35.4, strategic partners 27.5, founders 15.2, Association 6.3, contributor reserve 5.8, early contributors 4.9, users and launch pools 4.9) is carried from 2026-08-11 and was not re-pulled: refresh. On-chain top-holder verification: refresh. Vault layer measured this run via api.morpho.org GraphQL: V1 $2,023,321,543 across 843 vaults with assets (1,399 exist), largest Gauntlet USDC Prime on Base $419,769,656 (20.75 percent), top ten 78.26 percent, Steakhouse and Smokehouse named V1 vaults $460,279,143 (22.75 percent, 94 vaults). V2 $4,750,950,520 across all 3,388 vaults enumerated in full (2,426 hold assets); the 2,388 outside the top thousand hold $1,081 combined. Largest Steakhouse USDG on Robinhood Chain $485,982,990 (10.23 percent), then Paypal USD Main $436.1M, Steakhouse Prime USDC (Base) $429.8M, Steakhouse High Yield USDC Edition $424.3M, Sentora RLUSD Main $367.0M; top ten 63.42 percent. Steakhouse-named V2 vaults $1,985,616,152 (41.79 percent, 155 vaults; no Smokehouse-named V2 vault exists, correcting the draft's pairing), Sentora-named $912,251,545 (19.20 percent), Gauntlet-named $336.7M, kpk $46.3M, Pendle's own USDC vault $63.3M, Moonwell-named $0.4M. V2 by chain: Ethereum $2.67B, Base $1.16B, Robinhood Chain $511.7M. V1 and V2 are not additive because V2 adapters can allocate into V1 vaults: deduplicated vault total is refresh.
- Recent-news scan (2026-08-11 to 2026-09-20): One new incident, the 2026-08-25 PT-reUSD liquidation cascade above, with no bad debt and no lender loss; MORPHO fell about 12 percent on the day. An X-wide scan across Morpho, Morpho Labs, Paul Frambot and the major curators over the window surfaced no other exploit, bad debt, curator failure or governance change, which the Safe nonce independently corroborates for governance. Adjacent, not Morpho's contract: Moonwell was exploited on Base on 2026-08-27 for $8.7M when a thin MAMO Chainlink feed was pushed from about $0.0106 to $0.4313; Moonwell-named Morpho V1 vaults hold about $11.0M across seven vaults today, Zyfai disabled them as a precaution, said its agents had rebalanced out beforehand and reported user funds safe, which we did not independently verify (refresh), and DeFiLlama's hacks list records three Moonwell price-feed incidents in eleven months (2025-11-04 $1.0M, 2026-02-15 $1.78M, 2026-08-27 $8.7M). Outstanding loans reached a reported record $5B on 2026-09-01, press putting 95 percent in stablecoins and 62 percent in USDC, with total deposits crossing $14B in late August. RedStone's Settle service went live on 2026-09-01 enabling same-block exits on Centrifuge's tokenized NYLIM high-yield bond fund and making HYB units usable as Morpho collateral; we confirmed the announcement exists and is dated, not the mechanics. Morpho Midnight, the fixed-rate product, is dated 2026-07-21 in press. Regulatory position unchanged since July: Commissioner Peirce's vault statement remains guidance with no rule, order or action against Morpho.
- Carried forward, unchecked this run: composition of the roughly 18 percent APY on Bitget's Morpho-powered USDC vault (refresh since August), the identity of the November 2025 MEV Capital vault behind the 3.6 percent bad-debt disclosure (refresh), and the April 2026 KelpDAO and Aave comparison figures, which come from our own Aave report rather than a fresh pull.
Maintained monthly. Methodology: DeFi Research Instruction v2.