Tiger Research: DeFi Lending is Becoming Modular, but the Risk Is Not

This article was written by Tiger Research. As institutional investors enter the on-chain lending market, DeFi is moving away from the single shared liquidity pool architecture towards a new structure characterized by risk isolation and specialized operational layers.

Key Takeaways

• The Lehman crisis and the Kelp DAO incident both revealed the same structural flaw: a single shared liquidity pool architecture can amplify the risk of a single asset, turning it into a systemic crisis. Traditional finance's response has been to separate each functional layer of the financial system.
• The DeFi ecosystem is evolving in the same direction, building a modular architecture centered around risk isolation.
• This shift is accelerating as RWA assets begin to flow on-chain.
• In a modular architecture, the capability of the operational layer that actually manages the product becomes a key differentiator.

1. Lessons from the Lehman Crisis

In September 2008, the collapse of Lehman Brothers triggered an unprecedented crisis. The Reserve Primary Fund (RPF), the third-largest money market fund in the world, suspended all redemptions within a single day.

At the time, RPF's investment in Lehman Brothers debt accounted for only 1.2% of its assets under management. Lehman's bankruptcy made this 1.2% unrecoverable, causing the fund's total asset value to drop from 100% of par to 98.8%. This was enough to break the fundamental principle of the money market fund industry maintaining a stable net asset value of $1 per share. The fund's per-share value fell below $1 to $0.97.

Once principal losses became apparent, panic spread almost immediately. Fearing greater losses from waiting, a historic bank run ensued, with redemption requests reaching $40 billion within two days. Unable to withstand such immense pressure, the fund froze its assets and halted all withdrawals.

The Lehman Brothers bankruptcy forced a comprehensive restructuring of traditional capital markets. In the money market fund sector, risk-tiered liquidity buffers and redemption restriction guidelines were thoroughly reformed. In the hedge fund industry, the sector learned from Lehman's rehypothecation risk, where a single prime broker centrally held client assets.

Consequently, assets and credit were structurally adjusted away from concentration in a single intermediary. Separating execution infrastructure from risk management, and diversifying risk exposure across multiple prime brokers, became the global standard for risk isolation. It was on this institutional foundation of separating infrastructure and risk to contain contagion that the asset management industry was able to rebuild operational trust and resume growth.

2. How Traditional Capital Markets Solved This Problem

In 2014, the U.S. Securities and Exchange Commission restructured the money market fund (MMF) framework. Funds were categorized based on the nature of their capital, with different standards applying to each category. This was intended to prevent a run or failure in one fund type from spreading to other fund types or the entire system; each fund type had its own dedicated buffer mechanism.

The core concept of traditional financial risk control methods is separation. Power is decentralized, avoiding risk concentration in any single link, and independent verification mechanisms are introduced at every stage of capital flow.

Prime brokerage services in capital markets best exemplify this principle. Investment decision-making authority rests with the hedge fund, while risk supervision authority is exercised by the broker. These two functions are deliberately separated. In traditional lending markets, the same logic applies: credit assessment, underwriting, collateral management, and custody are handled by different independent institutions.

However, when asset management and lending began migrating to DeFi, the multi-layered intermediary structure built by traditional finance was compressed into a single layer. Early DeFi protocols focused on eliminating the intermediaries required for this separation, encoding the relevant mechanisms directly into smart contracts and automating processes previously handled by multiple parties.

3. From Shared Pools to Modular Architecture

Early DeFi's approach of compressing all lending mechanisms into a single smart contract reduced intermediary costs but also concentrated all risks within one protocol. Since credit assessment, underwriting, and collateral management all operate within the same codebase rather than as independent functions, a default or liquidation failure on a single asset could directly paralyze the entire system's liquidity.

This potential for contagion forced protocol governance to conservatively set risk parameters. Assets with short track records or high volatility, and virtually anything beyond Bitcoin and Ethereum, were structurally excluded from collateral eligibility. The compression of functions into a single contract paradoxically led to decreased capital efficiency: limited asset diversity and restricted market access.

Silo Finance addressed the risk concentration of unified asset pools by introducing independent lending pools for each asset. By limiting price manipulation or value collapse to a single collateral pool and preventing risk from spreading to other pools, Silo demonstrated that governance approval thresholds could be lowered and new lending markets could be opened more quickly. This architecture showed that a single large asset pool could be split and risks isolated at the market level, also laying the groundwork for subsequent layered modular structures.

The modular system pioneered by Silo became the foundational standard for on-chain lending, especially as RWA assets, including tokenized treasuries and private credit, began flowing onto the chain in large volumes. Each type of RWA has fundamental differences in trading hours, oracle reliability, regulatory requirements like KYC and AML, and liquidation procedures. The early shared pool model, requiring a single set of uniform parameters to manage such diverse assets, was clearly infeasible.

The influx of Real World Assets (RWA) created a need that went beyond simple asset isolation. It required transplanting the complex risk control framework of traditional finance into the on-chain environment. As assets diversified, the risks appearing on-chain became increasingly complex. Controlling these risks necessitated a structural separation: on one side, an immutable infrastructure layer responsible for liquidation and settlement; on the other, an operational layer with real-time authority to adjust and assume risk parameters.

Early DeFi compressed the intermediary layers of finance into a single codebase. As RWAs flooded in and the lending market matured, the development path changed: liquidation and settlement efficiency were delegated to the blockchain, while risk supervision authority was separated into an independent layer. To cope with increasingly complex assets, on-chain lending ultimately formed an architecture similar to the traditional financial system (e.g., prime brokers and independent credit assessment), where investment and risk monitoring are separated. This modular architecture has become the new standard for the on-chain lending market.

4. Institutional-Grade Risk Isolation and Convergence

Although the modular architecture originated within the DeFi ecosystem itself, it coincidentally meets the risk control standards demanded by institutional participants.

Morpho's decision to prioritize complete risk isolation at the base infrastructure layer, even at the cost of some capital efficiency, also spurred institutional demand. This demand became a turning point, prompting other major lending protocols, especially those initially adopting shared pool structures, to move in the same direction.

4.1 Morpho Blue: Prime Broker

Morpho initially started as an intermediary layer designed to optimize interest rates on top of first-generation DeFi lending protocols like Aave and Compound. In this model, it could not exist independently. In 2023, Morpho published the Morpho Blue whitepaper, and in early 2024 launched Morpho Blue and Morpho Vaults, formally declaring its independent operation.

This shift abandoned the previous structure where governance handled all market risk decisions and separated market creation and risk judgment from the protocol itself. This separation became the structural foundation for institutional participants to select and control risks according to their own compliance standards.

Architecture

• Morpho Blue: An immutable protocol. Upon market creation, five parameters are fixed: collateral asset, borrow asset, Liquidation Loan-To-Value (LLTV) ratio, price feed, and interest rate model. Anyone can create a market permissionlessly. The protocol itself is only responsible for executing pre-written code.
• Morpho Vaults: A risk management layer where independent curators select eligible markets, set supply limits, and allocate funds. Each vault has a unique risk profile.
• Lenders: Depositors with varying risk tolerances, including DAOs, protocols, individuals, and hedge funds, who choose a vault matching their profile and provide funds.

Traditional prime brokers typically perform four functions: clearing, custody, leverage provision, and risk monitoring. Morpho automates clearing and leverage provision at the protocol level through smart contracts. However, due to its non-custodial structure, it cannot provide the custodial environment institutional investors need to meet regulatory requirements. Therefore, integration with external custodians like Coinbase or Anchorage is necessary.

Similarly, risk monitoring does not depend on the protocol itself but on each custodian's ability to select assets and manage risk exposure. This creates a persistent risk: the varying quality of custodians. The xUSD and Stream Finance incidents in 2025 directly exposed this vulnerability. Multiple Morpho vaults held xUSD exposure and incurred bad debt. Following these events, the market began scrutinizing custodians' asset selection capabilities and real-time risk management more rigorously, with institutional capital concentrating on top-tier, high-performing custodians like Steakhouse, Gauntlet, and Sentora.

Traditional brokerage integrates clearing, custody, leverage, and collateral management within a single institution. Morpho replaces this model with a division of labor model, assigning functions to specialized participants within the ecosystem rather than centralizing them in one entity.

Institutional adoption is happening on a large scale, starting with centralized exchanges.

• Coinbase: USDC lending service built on Morpho Blue, with custodial services provided by Steakhouse Financial.
• Binance: Adopted the same structure, with Steakhouse Financial and Gauntlet acting as curators.

Users on the Coinbase or Binance apps simply click a "Lend" button to obtain loans. The world's two largest exchanges by trading volume have chosen the same architecture. This architecture has also expanded to traditional financial institutions.

• SG-FORGE: Deployed MiCA-compliant stablecoins EURCV and USDCV on Morpho.
• Apollo: Brought private credit fund ACRED on-chain, using it as collateral on Morpho.
• Bitwise: Conducts risk management directly on top of Morpho Vaults.

If tokenization opened the door to accessing assets, Morpho has paved the way for transforming these assets into productive capital. The trajectory set by Morpho is gradually revealing a new evolutionary direction that is difficult for lending protocols starting from different points to ignore.

4.2 Aave V4: Universal Bank

Aave, initially named ETHLend, was a peer-to-peer loan matching platform before evolving through versions V1, V2, and V3 into a shared liquidity pool architecture. In March 2026, Aave activated V4 on the Ethereum mainnet, which features a modular architecture. Unlike Morpho's choice to structurally separate infrastructure and operations, Aave V4 chose a hybrid model that controls risk while maintaining liquidity efficiency.

Aave recognizes the trade-off between risk isolation and capital efficiency. Moving towards risk isolation can contain the spread of bad debt but will weaken liquidity network effects and reduce capital efficiency. V4's design aims to structurally address this trade-off.

Architecture

• Hub: The core layer integrating liquidity and accounting. It allocates credit limits and debit limits to each Spoke, restricting the liquidity that can be drawn from any specific market. Basic risk firewalls are formed by these Spoke limits and local parameters.
• Spoke: An independent lending market, with individual parameters for each asset. When a problem occurs in a particular Spoke or asset, governance and risk managers can reduce risk exposure by adjusting the credit limit for that Spoke, restricting new borrowing, or initiating emergency controls. Since the maximum risk exposure is fixed by the credit limit, structural contagion from systemic spread is limited by design.

In traditional finance, this structure resembles the internal credit limit allocation system of a universal bank. The head office assigns credit limits to each department, and when a department faces difficulties, the head office adjusts these limits to control the spread. The central Hub acts like the head office, while each Spoke operates like an independent business unit. Unlike Morpho's fully isolated model, where capital is strictly locked within each asset pair, this Hub-and-Spoke structure allows unused liquidity in one Spoke to be flexibly reallocated to more efficient Spokes via the Hub's credit lines. The result is higher capital efficiency.

This structure becomes a significant advantage in the RWA market. Emerging RWA markets often struggle to attract initial liquidity. However, in Aave V4, the existing liquidity center can serve as a seeding mechanism for new Spoke markets. By structuring a tokenized asset as an independent Spoke and setting a credit limit from the Hub, it becomes possible to leverage the liquidity base of safer assets to bring new asset classes to market with lower startup costs, while keeping the initial exposure within the credit limit.

Institutional adoption primarily revolves around Horizon. Horizon initially launched as an independent RWA lending instance built on Aave v3.3, but its design philosophy aligns with V4's direction of unified liquidity and risk separation. As Horizon integrates more deeply with V4's credit limit structure, it is likely to become further integrated into Aave's institutional RWA layer.

Horizon aims to allow regulated tokenized treasuries, money market funds, and institutional funds to serve as collateral for stablecoin borrowing, with potential expansion into asset classes like tokenized stocks and ETFs.

Since approved institutional assets within Horizon are connected to the same institutional liquidity layer, any newly added RWA can immediately leverage the existing stablecoin liquidity.

The roles within this liquidity layer are divided as follows:

• Issuer: Manages investor access and KYC/AML allowlisting.
• Risk Manager (LlamaRisk): Conducts RWA due diligence, proposes risk frameworks and parameters.
• Oracle (Chainlink): Provides on-chain price feeds.
• Protocol (Aave): Executes smart contracts.

In a traditional Aave market, adding a new asset requires deliberation and voting by the DAO governance committee, which slows down the process. Horizon separates these responsibilities: the Issuer handles compliance for each asset, LlamaRisk manages risk due diligence, and Chainlink handles price verification. This architecture allows for much faster onboarding and risk adjustment of institutional assets than if all decisions go through the DAO governance committee.

Morpho minimizes governance involvement and outsources market creation and risk management, choosing speed and optionality; Aave chose a different path: controlling governance delegation and sharing liquidity to maintain capital efficiency.

Both approaches are coherent solutions for transplanting traditional finance's risk allocation principles into the on-chain environment. However, it remains to be seen which direction the RWA market will ultimately favor.

4.3 Euler V2: Multi-Strategy Hedge Fund

In March 2023, Euler suffered a $197 million loss. The attack exploited a vulnerability in the smart contract code. Because multiple asset markets were connected within the same protocol's accounting and liquidation structure, the losses spread across various assets.

After approximately three weeks of negotiation, most of the stolen assets were recovered. Nevertheless, Euler chose to rebuild the architecture rather than just patch it, subsequently repositioning itself as a flexible institutional lending infrastructure.

Euler's drive