Tiger Research: DeFi Lending Is Becoming Modular, but the Risks Are Not

This article is written by Tiger Research. As institutional investors enter the on-chain lending market, DeFi is moving away from the single shared liquidity pool architecture towards a new structure focused on risk isolation and specialized operational layers.

Key Takeaways

• The Lehman crisis and the Kelp DAO incident revealed the same structural flaw: a single shared liquidity pool architecture amplifies the risk of a single asset, turning it into a systemic crisis. Traditional finance's response was to separate each functional layer of the financial system.
• The DeFi ecosystem is moving in the same direction, building a modular architecture centered on risk isolation.
• This shift has accelerated as RWA assets begin to flow on-chain.
• In a modular architecture, the capability of the operational layer that actually manages the product becomes a key differentiator.

1. Lessons from the Lehman Crisis

In September 2008, the collapse of Lehman Brothers triggered an unprecedented crisis, with the Reserve Primary Fund (RPF), the third-largest money market fund globally, suspending all redemptions within a single day.

At the time, RPF's investment in Lehman Brothers debt represented only 1.2% of its assets under management. Lehman's bankruptcy rendered this 1.2% unrecoverable, causing the fund's total asset value to drop from 100% of par value to 98.8%. This was enough to break the fundamental principle of the money market fund industry: maintaining a fixed net asset value of $1 per share. The fund's per-share value fell below $1 to $0.97.

Once the principal loss was apparent, panic spread almost immediately. Fearing greater losses from waiting, a historic bank run ensued, with redemption requests reaching $40 billion within two days. Unable to withstand such immense pressure, the fund froze its assets and halted all withdrawals.

The Lehman Brothers bankruptcy forced a comprehensive restructuring of traditional capital markets. In the money market fund sector, rules regarding risk-tiered liquidity buffers and redemption restrictions were overhauled. In the hedge fund space, the industry learned from Lehman's rehypothecation risk, where a single prime broker centrally custodies client assets.

Consequently, assets and credit were structurally adjusted away from concentration in a single intermediary. Separating execution infrastructure from risk management, and diversifying exposure across multiple prime brokers, became the global standard for risk isolation. It was this institutional safeguard of separating infrastructure from risk to contain contagion that allowed the asset management industry to rebuild operational trust and resume growth.

2. How Traditional Capital Markets Addressed This

In 2014, the U.S. Securities and Exchange Commission restructured the money market fund (MMF) framework. Funds were categorized based on the nature of their capital, with different standards applying to each category. This aimed to prevent a run or bankruptcy in one fund category from spreading to other fund types or the entire system, with each category having its own dedicated buffer mechanism.

The core philosophy of traditional financial risk control methods is separation. Power is decentralized to avoid risk concentration in a single point, and independent verification mechanisms are introduced at every stage of capital flow.

This principle is best exemplified in the prime brokerage business within capital markets. Investment decision-making authority rests with the hedge fund, while risk supervision authority is exercised by the broker. These two functions are deliberately separated. In traditional lending markets, the same logic applies: credit assessment, underwriting, collateral management, and custody are handled by different, independent institutions.

However, when asset management and lending began migrating to DeFi, the multi-layered intermediary structure built by traditional finance was compressed into a single layer. Early DeFi protocols focused on eliminating the intermediaries required for this separation, encoding the relevant mechanisms directly into smart contracts, and automating processes previously handled by multiple parties.

3. From Shared Pools to Modular Architecture

Early DeFi's approach of compressing all lending mechanisms into a single smart contract reduced intermediary costs but also concentrated all risk within one protocol. Since credit assessment, underwriting, and collateral management operated within the same codebase rather than as independent functions, a default or liquidation failure of a single asset could directly lead to the paralysis of the entire system's liquidity.

This potential for contagion forced protocol governance to conservatively set risk parameters. Assets with short track records or high volatility, and any asset other than Bitcoin and Ethereum, were structurally excluded from collateral eligibility. Compressing functions into a single contract paradoxically led to decreased capital efficiency: asset diversity was limited, and market access was restricted.

Silo Finance addressed the risk concentration of unified asset pools by introducing independent lending pools for each asset. By limiting price manipulation or value crashes to a single collateral pool and preventing risk from spreading to other pools, Silo demonstrated that it was possible to lower the governance approval threshold and open new lending markets more quickly. This architecture showed that a single large pool could be split, isolating risk at the market level, and also laid the foundation for subsequent layered modular structures.

Silo's pioneering modular system became a foundational standard for on-chain lending, especially as RWA assets, including tokenized treasuries and private credit, began flowing onto the chain in large volumes. Each type of RWA has fundamental differences in trading hours, oracle reliability, regulatory requirements like KYC and AML, and liquidation procedures. The early shared pool model, requiring a single, uniform set of parameters to manage such diverse assets, was clearly infeasible.

The influx of Real World Assets (RWA) created a need beyond simple asset isolation. It required transplanting the complex risk control frameworks of traditional finance into the on-chain environment. As asset diversity increased, the risks appearing on-chain also became increasingly complex. Controlling these risks necessitated structural separation: one part is the immutable infrastructure layer responsible for liquidation and settlement, and the other is the operational layer with real-time authority to adjust and assume risk parameters.

Early DeFi compressed the intermediary layers of finance into a single codebase. With the influx of RWAs and the maturation of the lending market, the development path changed: liquidation and settlement efficiency were delegated to the blockchain, while risk supervision authority was separated into an independent layer. To handle increasingly complex assets, on-chain lending ultimately formed an architecture similar to traditional financial systems (e.g., prime brokers and independent credit assessments), where investment and risk monitoring are separated. This modular architecture has become the new standard for the on-chain lending market.

4. Institutional-Grade Risk Isolation and Convergence

Although the modular architecture originated within the DeFi ecosystem itself, it perfectly aligns with the risk control standards demanded by institutional participants.

Morpho's decision to prioritize complete risk isolation at the base infrastructure layer, even at the cost of some capital efficiency, generated institutional demand. This demand became a turning point, prompting other major lending protocols, especially those initially adopting shared pool structures, to move in the same direction.

4.1 Morpho Blue: The Prime Broker

Morpho originally started as an intermediary layer optimizing interest rates on top of first-generation DeFi lending protocols like Aave and Compound. In this model, it couldn't exist independently. In 2023, Morpho published the Morpho Blue whitepaper, and in early 2024 launched Morpho Blue and Morpho Vaults, formally declaring its independent operation.

This shift abandoned the previous structure where governance made all market risk decisions, separating market creation and risk assessment from the protocol itself. This separation became the structural foundation for institutional participants to select and control risk according to their own compliance standards.

Architecture

• Morpho Blue: An immutable protocol. Upon market creation, five parameters are fixed: collateral asset, borrowable asset, Liquidation Loan-to-Value (LLTV), price feed, and interest rate model. Anyone can create a market permissionlessly. The protocol itself only executes pre-written code.
• Morpho Vaults: A risk management layer where independent curators select eligible markets, set supply limits, and allocate capital. Each vault has a unique risk profile.
• Lenders: Depositors with varying risk tolerances, including DAOs, protocols, individuals, and hedge funds, choose a vault matching their profile and provide funds.

Traditional prime brokers typically perform four functions: clearing, custody, leverage provision, and risk monitoring. Morpho automates clearing and leverage provision at the protocol level via smart contracts. However, due to its non-custodial structure, it cannot provide the custodial environment institutions need to meet regulatory requirements. Therefore, integration with external custodians like Coinbase or Anchorage is necessary.

Similarly, risk monitoring doesn't depend on the protocol itself but on each custodian's ability to select assets and manage risk exposure. This creates a persistent risk: variable quality among custodians. The xUSD and Stream Finance incidents in 2025 directly exposed this vulnerability. Multiple Morpho vaults held xUSD exposure and incurred bad debt. Following the incident, the market began scrutinizing custodians' asset selection capabilities and real-time risk management more strictly, with institutional capital concentrating on top-tier, high-performing custodians like Steakhouse, Gauntlet, and Sentora.

Traditional brokerage integrates clearing, custody, leverage, and collateral management within a single institution. Morpho replaces this with a division-of-labor model, assigning these functions to specialized participants within the ecosystem rather than concentrating them in one institution.

Institutional adoption is happening at scale, and it began with centralized exchanges.

• Coinbase: USDC lending service built on Morpho Blue, curated by Steakhouse Financial.
• Binance: Adopted the same structure, with Steakhouse Financial and Gauntlet acting as curators.

Users clicking the "Borrow" button on the Coinbase or Binance app receive a loan. The world's two largest exchanges by trading volume chose the same architecture. This architecture has also expanded to traditional financial institutions.

• SG-FORGE: Deployed MiCA-compliant stablecoins EURCV and USDCV on Morpho.
• Apollo: Onboarded the private credit fund ACRED onto the chain for use as collateral on Morpho.
• Bitwise: Manages risk directly on top of Morpho Vaults.

If tokenization opened the door to accessing assets, Morpho paved the way for converting those assets into productive capital. The trajectory set by Morpho is gradually revealing a new evolutionary direction that lending protocols with vastly different starting points find difficult to ignore.

4.2 Aave V4: The Universal Bank

Aave, originally named ETHLend, was a peer-to-peer lending matching platform. It went through versions V1, V2, and V3, gradually evolving into a shared liquidity pool architecture. In March 2026, Aave activated version V4 on the Ethereum mainnet, which is a modular architecture. Unlike Morpho's structural separation of infrastructure and operations, Aave V4 opted for a hybrid model, controlling risk while maintaining liquidity efficiency.

Aave recognized the contradiction between risk isolation and capital efficiency. Moving towards risk isolation can contain the spread of bad debt, but it weakens liquidity network effects and reduces capital efficiency. V4's design aims to structurally address this trade-off.

Architecture

• Hub: The core layer that aggregates liquidity and accounting. It assigns credit limits and borrowing limits to each Spoke, restricting the liquidity extractable by any specific market. Basic risk firewalls are formed by these Spoke limits and local parameters.
• Spoke: An independent lending market, each asset having its own independent parameters. When an issue arises in a Spoke or an asset, governance and risk managers can reduce risk exposure by adjusting the credit limit for that Spoke, limiting new borrowing, or activating emergency controls. Since the maximum risk exposure is fixed by the credit limit, structural contagion is limited by design.

In traditional finance, this structure resembles a universal bank's internal credit limit allocation system. The head office allocates credit limits to each department, and when a department faces difficulties, the head office adjusts these limits to control the spread. The central hub acts as the head office, while each Spoke operates like an independent business unit. Unlike Morpho's fully isolated model (where capital is strictly locked within each asset pair), this hub-and-spoke structure allows unused liquidity in one Spoke to be flexibly reallocated to more efficient Spokes via the hub's credit lines. The result is higher capital efficiency.

This structure becomes a significant advantage in the RWA market. Emerging RWA markets often struggle to attract initial liquidity. In Aave V4, however, the existing liquidity hub can serve as a seeding mechanism for new Spoke markets. By structuring a tokenized asset as an independent Spoke with a credit limit from the hub, one can leverage the liquidity base of safer assets to bring new asset classes to market with lower startup costs, while keeping initial exposure within the credit limit.

Institutional adoption primarily revolves around Horizon. Originally launched as an independent RWA lending instance based on Aave v3.3, its design philosophy aligns with V4's direction of unified liquidity and risk separation. As Horizon integrates more deeply with V4's credit line structure, it is likely to further assimilate into Aave's institutional RWA layer.

Horizon aims to allow regulated tokenized treasuries, money market funds, and institutional funds to serve as collateral for stablecoin lending, with potential expansion into asset classes like tokenized stocks and ETFs.

Because approved institutional assets within Horizon are linked to the same institutional liquidity layer, any newly added RWA can immediately utilize existing stablecoin liquidity.

The role division within this liquidity layer is as follows:

• Issuers: Manage investor access and KYC/AML allowlists.
• Risk Managers (LlamaRisk): Conduct RWA due diligence, develop risk frameworks, and propose parameters.
• Oracle (Chainlink): Provide on-chain price feeds.
• Protocol (Aave): Execute smart contracts.

In the traditional Aave market, adding a new asset requires deliberation and voting by the DAO governance committee, slowing down the process. Horizon separates these responsibilities: issuers handle compliance for each asset, LlamaRisk manages risk due diligence, and Chainlink handles price verification. This architecture allows for significantly faster institutional asset onboarding and risk adjustment compared to routing all decisions through DAO governance committee approval.

Morpho minimizes governance involvement, outsourcing market creation and risk management in favor of speed and optionality. Aave chose a different path: controlling governance delegation and shared liquidity to maintain capital efficiency.

Both approaches are coherent solutions for transplanting traditional finance's risk allocation principles into the on-chain environment, but it remains to be seen which direction the RWA market will ultimately lean towards.

4.3 Euler V2: The Multi-Strategy Hedge Fund

In March 2023, Euler suffered a loss of $197 million. The attack exploited a vulnerability in the smart contract code. Because multiple asset markets were connected within the same protocol's accounting and liquidation structure, losses spread to several assets.

After approximately three weeks of negotiations, most of the stolen assets were recovered. Nevertheless, Euler chose to rebuild its architecture rather than just patch it, subsequently repositioning itself as a flexible institutional lending infrastructure.

Euler's drive into the RWA and institutional credit market stems from the