Is Morpho Safe?
Risk Grade: B- (32/100)
Morpho is rated as moderate risk — some novel mechanisms, generally well-understood.
Moderate risk — elegant design at massive scale, but permissionless market creation and curator trust introduce real attack surface
A lending protocol that matches borrowers and lenders directly for better rates, managing $6.8B in deposits with $73.6M in funding. It also lets anyone create isolated lending markets with custom rules. Its B- grade reflects strong architecture and rapid growth, offset by the risk that anyone can create a market with a bad price feed that curators accidentally funnel your deposits into.
TVL
$6.6B
Mechanisms
8
Interactions
5
Value Grade
C
Key Risks for Morpho Users
Anyone can create a lending market with any price feed. If a market uses a manipulable price source, an attacker can inflate collateral value and steal deposited funds from that market.
Vault curators decide where your deposits go across multiple markets. If a curator makes a bad allocation into a risky market, all vault depositors share the losses.
At $6.8B, Morpho is one of DeFi's largest lending protocols but has a shorter track record than Aave or Compound. It has not been tested through a severe market crash at this scale.
Top Risk Factors
- •P2P matching engine adds complexity: if matching fails, fallback to pool rates may surprise users
- •Morpho Blue's permissionless market creation allows risky collateral/oracle combinations to emerge
- •Two 2025 incidents: Bundler3 vulnerability put $2.6M at risk (white hat saved), and xUSD bad debt (~$700K) from Balancer hack cascade
- •Relatively short track record at scale compared to Aave/Compound; untested through a severe market crash
How Morpho Compares to Peers
Morpho ranks #28 of 90 Lending protocols (above-median). At a risk score of 32/100, it's 5 points safer than the sector average of 37/100.
Adjacent peers: YeiLend (B-, 31/100) is ranked just safer, and Save (B-, 32/100) is ranked just riskier.
Morpho holds 16% of TVL across all rated Lending protocols ($6.6B of $40.2B total).
See the full Lending sector leaderboard or the Morpho vs Save comparison.
Common Questions about Morpho
Plain-English answers based on Morpho's scores across Hindenrank's 8 risk dimensions. The highest-scoring (riskiest) dimension is Scale Exposure (9/10).
Has Morpho ever been hacked or exploited?
Morpho has a fairly clean operational history. The track record dimension scored 3/15, indicating minor or no significant incidents on record. A clean track record is a positive signal but it does not guarantee future safety, especially as protocol complexity grows.
How much money is at stake in Morpho?
Morpho currently holds over $6.6B in user deposits. A protocol of this size typically has deeper liquidity, more eyes on the code, and more attention from auditors — but it also means a single failure has a much larger blast radius.
What's the worst-case scenario for Morpho?
Hindenrank has identified specific collapse scenarios for Morpho. The most prominent: "Permissionless Market Oracle Exploit Cascade". The trigger condition is A permissionless Morpho Blue market with a manipulable custom oracle accumulates $50M+ TVL before the oracle is exploited, and MetaMorpho vault curators have allocated depositor funds to it. Reading through the full scenario list on the protocol page is the single best way to understand the actual failure modes — generic "smart contract risk" is rarely the thing that takes a protocol down.
Is Morpho regulated or insured?
Morpho has low regulatory exposure on Hindenrank's framework (2/10). The protocol is structured in a way that minimizes counterparty and jurisdiction concentration, though regulatory risk in crypto can change rapidly. No DeFi protocol carries FDIC-style insurance — even with low regulatory risk, depositors are not protected in the way bank customers are.
What are the biggest red flags for Morpho?
Hindenrank's retail-focused risk audit flagged: Anyone can create a lending market with any price feed. If a market uses a manipulable price source, an attacker can inflate collateral value and steal deposited funds from that market. Vault curators decide where your deposits go across multiple markets. If a curator makes a bad allocation into a risky market, all vault depositors share the losses. At $6.8B, Morpho is one of DeFi's largest lending protocols but has a shorter track record than Aave or Compound. It has not been tested through a severe market crash at this scale.
Should beginners deposit into Morpho?
Morpho is rated B-, which is acceptable for users who understand the protocol's mechanism. Beginners should read the full risk breakdown and only deposit after they can articulate the top three failure modes. If you cannot explain how the protocol works, do not deposit.
How does Morpho compare to safer Lending alternatives?
Morpho is one protocol in Hindenrank's Lending coverage. The safest Lending protocols on the leaderboard tend to share three traits: a long incident-free track record, conservative mechanism design, and high-quality public documentation. Compare Morpho against the full Lending ranking before committing capital.
For the full 8-dimension score breakdown, the radar chart, and dependency graph, see the Morpho risk report.
Read the Full Morpho Risk Report
This protocol has 2 collapse scenarios. 2 high-severity interaction risks identified. See the full mechanism classification, interaction matrix, and deep-dive recommendations.
View Full Report →Get risk alerts before it's too late
Weekly grade changes, downgrade alerts, and new protocol risk findings. Free.