S&P GLOBAL WILL NOW GRADE DEFI VAULTS — THE SAME DAY, A $6 MILLION VAULT RUN BY SEVEN UNNAMED KEYHOLDERS WAS DRAINED — THREE OF ITS KEYS SIGNED THE ATTACKER BACK IN

S&P Global Ratings started grading DeFi vaults on October 4, 2026. Its Vault Risk Assessment is "not a credit rating." It is S&P's opinion of how likely you are to lose money in a lending vault, a pool that takes deposits and lends them out "much like managed fixed income funds." Two of the six risks it scores are the curator and the vault's security and governance. No vault has a grade yet.

The same day, a vault on Base lost 1,783 wstETH, about $6 million. It was run by a Safe multisig with seven keys, three needed to sign. Nobody has said whose keys they are. Security firm ExVul says the attacker's contract was pulled off the vault's whitelist at 08:52 UTC and put back a minute later, signed by three of the vault's own keys.

That is the risk S&P is grading. Not the code. The people holding the keys, and whether their keys are still theirs. The vault had seven keyholders, and three were enough.

Bitcoin in your own wallet has one keyholder and no curator to rate. There is no whitelist to add a stranger to. At the time of this writing, bitcoin was $85,441.