Is Ondo USDY Safe?
Risk Grade: C (46/100)
Ondo USDY is rated as elevated risk — multiple novel mechanisms and notable interaction risks.
Elevated risk — single custodian concentration and centralized governance at $2.64B scale, partially offset by strong regulatory structure, clean track record, and Morgan Stanley Smith Barney custodianship.
Ondo USDY is a yield-bearing tokenized note backed by short-term US Treasuries and the BlackRock iShares Short Treasury Bond ETF, held in custody by Morgan Stanley Smith Barney LLC. With $2.64B in tokenized assets across 12+ blockchains and a ~3.5% APY, USDY is among the largest tokenized Treasury products in DeFi. The C+ grade reflects its dependence on a single custodian, centralized admin control by Ondo Finance, and significant geographic restrictions (barred for US persons), offset by a clean 3-year track record and the strong regulatory framework of its Reg S security structure.
TVL
$2.6B
Mechanisms
6
Interactions
5
Value Grade
B
Key Risks for Ondo USDY Users
Single custodian risk: all $2.64B in backing assets are held by Morgan Stanley Smith Barney LLC via StoneX as broker. A custodian failure, regulatory freeze, or Ondo entity insolvency could prevent redemptions. The bankruptcy-remote structure provides legal protection but not instant liquidity recovery.
Centralized admin control: Ondo Finance controls all USDY smart contract upgrades, yield rate settings (adjusted monthly), and allowlist management with no DAO governance or timelock. Product parameters can change without holder consent.
Restricted access: USDY is a Regulation S security explicitly prohibited for US persons and barred or restricted in multiple other jurisdictions. Regulatory reclassification or enforcement action could trigger product wind-down or emergency transfer restrictions.
Chainalysis oracle dependency: every USDY transfer queries the Chainalysis sanctions oracle. Sustained oracle downtime blocks all transfers, and DeFi protocols integrating USDY would experience disruption until service is restored.
Top Risk Factors
- •Single custodian concentration: all $2.64B in backing assets (US Treasuries, BlackRock iShares ETF, bank deposits) are held by Morgan Stanley Smith Barney LLC. A custodian failure, freeze, or regulatory action against the custodian would prevent USDY redemptions, with no backup custodian arrangement disclosed.
- •Ondo Finance retains unilateral control over USDY contract upgrades (ProxyAdmin), yield rate setting (monthly), and the allowlist registry. This centralized governance means product parameters can change without holder consent.
- •USDY is a Regulation S security explicitly prohibited for US persons and residents of several other jurisdictions. A regulatory reclassification, enforcement action against Ondo's BVI issuing entity, or sanctions against the custodian could force product wind-down.
- •The Chainalysis oracle is queried on every USDY transfer for sanctions screening. If the oracle is unavailable or inaccurately sanctions legitimate addresses, transfers fail; if the oracle is compromised, sanctioned addresses could bypass compliance checks.
How Ondo USDY Compares to Peers
Ondo USDY ranks #59 of 77 RWA protocols (bottom quartile — among the riskiest). At a risk score of 46/100, it's 8 points riskier than the sector average of 38/100.
Adjacent peers: xStocks (C, 45/100) is ranked just safer, and Ondo Global Markets (C, 46/100) is ranked just riskier.
Ondo USDY holds 7% of TVL across all rated RWA protocols ($2.6B of $37.0B total).
See the full RWA sector leaderboard or the Ondo USDY vs Ondo Global Markets comparison.
Common Questions about Ondo USDY
Plain-English answers based on Ondo USDY's scores across Hindenrank's 8 risk dimensions. The highest-scoring (riskiest) dimension is Scale Exposure (7/10).
Has Ondo USDY ever been hacked or exploited?
Ondo USDY has a fairly clean operational history. The track record dimension scored 3/15, indicating minor or no significant incidents on record. A clean track record is a positive signal but it does not guarantee future safety, especially as protocol complexity grows.
How much money is at stake in Ondo USDY?
Ondo USDY currently holds over $2.6B in user deposits. A protocol of this size typically has deeper liquidity, more eyes on the code, and more attention from auditors — but it also means a single failure has a much larger blast radius.
What's the worst-case scenario for Ondo USDY?
Hindenrank has identified specific collapse scenarios for Ondo USDY. The most prominent: "Custodian Failure Prevents USDY Redemptions". The trigger condition is Morgan Stanley Smith Barney LLC faces regulatory asset freeze, insolvency, or operational failure, OR Ondo Global Markets (BVI) Limited is sanctioned or dissolved, severing access to the $2.64B in backing T-bills and ETF shares.. Reading through the full scenario list on the protocol page is the single best way to understand the actual failure modes — generic "smart contract risk" is rarely the thing that takes a protocol down.
Is Ondo USDY regulated or insured?
Ondo USDY faces material regulatory exposure (7/10 on this dimension). This may stem from counterparty concentration, jurisdiction risk, or specific products attracting enforcement attention. Users in regulated jurisdictions should consider whether they are comfortable with this profile before depositing. No DeFi protocol carries FDIC-style insurance — even with low regulatory risk, depositors are not protected in the way bank customers are.
What are the biggest red flags for Ondo USDY?
Hindenrank's retail-focused risk audit flagged: Single custodian risk: all $2.64B in backing assets are held by Morgan Stanley Smith Barney LLC via StoneX as broker. A custodian failure, regulatory freeze, or Ondo entity insolvency could prevent redemptions. The bankruptcy-remote structure provides legal protection but not instant liquidity recovery. Centralized admin control: Ondo Finance controls all USDY smart contract upgrades, yield rate settings (adjusted monthly), and allowlist management with no DAO governance or timelock. Product parameters can change without holder consent. Restricted access: USDY is a Regulation S security explicitly prohibited for US persons and barred or restricted in multiple other jurisdictions. Regulatory reclassification or enforcement action could trigger product wind-down or emergency transfer restrictions.
Should beginners deposit into Ondo USDY?
Ondo USDY's C grade puts it in the elevated-risk band. This is not a beginner-friendly protocol. Anyone depositing here should treat the position as speculative and avoid concentrating significant savings in it.
How does Ondo USDY compare to safer RWA alternatives?
Ondo USDY is one protocol in Hindenrank's RWA coverage. The safest RWA protocols on the leaderboard tend to share three traits: a long incident-free track record, conservative mechanism design, and high-quality public documentation. Compare Ondo USDY against the full RWA ranking before committing capital.
For the full 8-dimension score breakdown, the radar chart, and dependency graph, see the Ondo USDY risk report.
Read the Full Ondo USDY Risk Report
This protocol has 2 collapse scenarios. 2 high-severity interaction risks identified. See the full mechanism classification, interaction matrix, and deep-dive recommendations.
View Full Report →Get risk alerts before it's too late
Weekly grade changes, downgrade alerts, and new protocol risk findings. Free.