Credit · Lending · MORPHO
Morpho is a lending protocol built around Morpho Blue, a minimal primitive for creating isolated markets, with MetaMorpho vaults that allocate deposits across those markets through risk curators.
Customizable lending infrastructure: isolated markets + curated vaults.
MORPHO price
$1.93
-1.4% 24h
Latest data · 15 min delay
Typed risks scored by severity, likelihood and impact, with the incident record behind them.
46
severity-weighted points across 16 typed risks · 4 critical
assessed May 2026Market
6· 2 risks
Technological
24· 9 risks · 2 critical
Counterparty
10· 3 risks · 1 critical
Governance
6· 2 risks · 1 critical
Regulatory
No rowsNo Regulatory risk rows in the dataset: a recorded finding (no fetchable regulatory exposure source), not missing data.
Every score is recomputed at render time from the typed risks below; nothing is hand-assigned. Each risk contributes its severity weight (critical 4 · high 3 · medium 2 · low 1) to its category; the headline number is the sum across all categories. Bars scale to this entity's highest category score. Scores are not comparable across tags because a permissionless-market protocol concentrates technological risk while an institutional-credit protocol concentrates counterparty and regulatory risk, and a single league table would misrepresent both.
Market 2 × → 6
Technological 9 × → 24
Counterparty 3 × → 10
Governance 2 × → 6
Morpho has almost no protocol-level risk and almost all of its risk in the layer above it. The immutable core is formally verified by Certora with a 2.5 million USD Cantina bounty (Morpho docs), and in three documented loss events the core behaved exactly as specified. The damage came from curators: who they listed, what oracles they accepted and how fast they reacted. Every major loss traces to a collateral issuer failing while an oracle told the market nothing was wrong, in the Aerodrome LP case (ClearstarLabs), in Stream's hardcoded xUSD price (TokenIntel) and in Resolv's hardcoded USR oracle exploited through the Public Allocator (Oak Research). Morpho's own documentation is unusually candid about the residual hazards, including donation attacks that supply caps do not stop and the last-depositor bank run in Vaults V1.1 (Morpho security considerations). The structural problem is that curator TVL grew 2,200 percent to 7 billion USD with no licensing and heavy concentration in five firms (Chorus One). Net posture: low technological risk in the base layer, critical and recurring counterparty and governance risk in the curated layer, with loss magnitude driven almost entirely by curator judgement.
Market2
Technological9
Counterparty3
Governance2
5 documented incidents · 10 Apr 2025 to 22 Mar 2026 · how the protocol behaved under stress, with sources.
10 Apr 2025
A front-end and SDK misconfiguration sent token approvals to the Bundler3 contract instead of the adapters, and one user's bundled transaction was intercepted.
DetailsA front-end and SDK misconfiguration sent token approvals to the Bundler3 contract instead of the adapters, and one user's bundled transaction was intercepted.
Outcome: The whitehat MEV bot c0ffeebabe.eth captured and returned the funds; the change was rolled back within four minutes and the contracts were unaffected.
Source25 May 2025
An attacker funded via Tornado Cash and bridged through Symbiosis flash-loaned 6,666,666.67 USDC, inflated the Aerodrome sAMM-cUSDO/USDC LP oracle, borrowed 363,935 USDC and self-liquidated at 23:29 UTC.
DetailsAn attacker funded via Tornado Cash and bridged through Symbiosis flash-loaned 6,666,666.67 USDC, inflated the Aerodrome sAMM-cUSDO/USDC LP oracle, borrowed 363,935 USDC and self-liquidated at 23:29 UTC.
Outcome: 49,303.14 USDC of bad debt was fully compensated by the curator, the market was set to close-only with allocations zeroed, and Clearstar OpenEden USDC Vault depositors were unharmed.
SourceNov 2025
Only one of roughly 320 MetaMorpho vaults, MEV Capital's, had direct xUSD exposure, carrying about 700,000 USD of bad debt.
DetailsOnly one of roughly 320 MetaMorpho vaults, MEV Capital's, had direct xUSD exposure, carrying about 700,000 USD of bad debt.
Outcome: Withdrawals were queued and rates spiked as high as 190 percent, with 80 percent of withdrawals completed within three days; even Steakhouse and Gauntlet USDC vaults were briefly illiquid.
Source4 Nov 2025
Stream Finance disclosed a 93 million USD external manager loss; xUSD had peaked at 520 million USD TVL on 160 million USD of deposits and vault oracles hardcoded xUSD near one dollar, blocking liquidations while utilisation hit 100 percent.
DetailsStream Finance disclosed a 93 million USD external manager loss; xUSD had peaked at 520 million USD TVL on 160 million USD of deposits and vault oracles hardcoded xUSD near one dollar, blocking liquidations while utilisation hit 100 percent.
Outcome: Bad debt ran into the hundreds of millions across at least fifteen Morpho vaults plus Euler; MEV Capital AUM fell from a 1.49 billion USD peak and Re7 from an 830 million USD peak.
Source22 Mar 2026
The Resolv protocol was exploited, minting 80 million USR from roughly 300,000 USDC across three requestSwap calls; the attacker walked away with nearly 25 million USD and about 11,400 ETH.
DetailsThe Resolv protocol was exploited, minting 80 million USR from roughly 300,000 USDC across three requestSwap calls; the attacker walked away with nearly 25 million USD and about 11,400 ETH.
Outcome: 6.2 million USD of bad debt reached Morpho vaults through the Public Allocator, with Gauntlet accounting for 96 percent of the losses; a compensation plan was announced and Re7 detected the exploit at 02:46 UTC while 9summits was hit at 12:33 PM UTC with 41,000 USD residual bad debt.
SourceEvent-type chips are categorised by event type against the risk taxonomy (a documented presentation mapping, not a dataset assessment). Amounts are the dataset's published figures; missing values were never published.
