Kraken launched Bitcoin Vault on Wednesday, a new yield product within its Kraken Earn suite that allows long-term BTC holders to earn bitcoin-denominated rewards through DeFi lending strategies without selling, wrapping, or manually managing assets across protocols.
The vault is powered by DeFi infrastructure provider Veda and operated by Sentora, a risk management firm. Customer assets are deployed across established onchain lending protocols including Aave, Morpho, and Tydro.
“Many bitcoin holders on Kraken have made it clear they want simple, safe ways to earn on the bitcoin they already plan to hold,” said John Zettler, GM of Payward Services and head of Kraken Earn Products. “Bitcoin Vault is built for that mindset.”
The product is integrated into both the Kraken and Krak apps and is available in eligible jurisdictions. Kraken’s broader DeFi Earn offering has surpassed $240 million in assets under management since launching in January 2026, with the company attributing growth to organic adoption rather than token incentives.
The Timing
The launch landed on what may be the single worst day for DeFi confidence in 2026.
Hours before Kraken’s announcement, OpenZeppelin co-founder Manuel Aráoz posted that he now considers “all of DeFi” unsafe. “Coding agents are superhuman at finding vulnerabilities, and smart contract security is too asymmetric: defenders need to fix every bug while attackers need just one exploit to steal funds,” he wrote. He said he had advised friends and family to exit DeFi entirely — including blue-chip protocols like Aave, MakerDAO, and Compound.
On the same day, Stake DAO was exploited after an attacker compromised the protocol’s deployer private key, reconfigured the LayerZero v2 OFT peer on the vsdCRV token contract, and minted 5.4 trillion tokens with a nominal value of $763 billion. Thin DEX liquidity limited actual extraction to approximately $91,000, but the mechanics — a single compromised key enabling unbounded minting — are identical to the attack pattern that has defined 2026’s costliest exploits.
Why the Juxtaposition Matters
The protocols Kraken is routing customer bitcoin into have not been immune to this year’s security crisis.
Aave, which is one of the three protocols Bitcoin Vault deploys into, absorbed roughly $196 million in bad debt from the $292 million Kelp DAO exploit in April. When the attacker used forged rsETH as collateral to borrow massive amounts of WETH, Aave’s TVL dropped from approximately $48.5 billion to $30.7 billion in a single day as depositors rushed to withdraw. The AAVE token fell over 18%. Aave froze rsETH and WETH reserves across Ethereum, Arbitrum, Base, Mantle, and Linea. The protocol’s Umbrella safety module was initially cited as sufficient to offset any bad debt, but Aave later revised that position.
Morpho, also named as a Bitcoin Vault deployment target, fared significantly better during the same event. Its isolated market architecture limited exposure to approximately $1 million across two markets, with other vaults entirely unaffected. Morpho subsequently absorbed roughly $8 billion in deposits rotating from Aave without triggering a bank run — a structural validation of its design. But isolation does not mean invulnerability, and Morpho has not been tested by a direct exploit of its own core contracts at this scale.
Tydro, the third protocol listed, is newer and has a smaller track record for comparison.
What Protects Bitcoin Vault Depositors?
Kraken has emphasized that Bitcoin Vault’s yield is sourced from real borrower demand on overcollateralized lending markets—not token incentives, subsidies, or rehypothecation. This is a fundamentally different architecture from the Celsius/Voyager/BlockFi models that collapsed in 2022, where customer deposits were lent out in opaque, undercollateralized structures with no onchain transparency.
The risk management layer is also explicit. Sentora operates the vault, Chaos Labs provides risk monitoring, and Veda handles strategy execution. Kraken has stated that users are shown offered rates, applicable fees, and potential risks before depositing, and that withdrawals are typically instant except during periods of constrained liquidity.
But the Kelp DAO incident demonstrated exactly how constrained liquidity can materialize. When Aave froze WETH reserves across multiple chains in April, utilization rates spiked to 100%, and some depositors could not withdraw. The freeze was a protective measure — but it also meant that capital was temporarily locked. Whether similar conditions could affect Bitcoin Vault depositors during a comparable event is a question Kraken’s press materials do not explicitly address.
The Broader Context
Kraken’s Bitcoin Vault is part of a 2026 yield arms race across exchanges. Bybit’s Mantle Vault hit $200 million in AUM within 94 days. Morpho’s curated vault system holds roughly $5.8 billion in TVL. Bitwise launched a Morpho USDC vault targeting 6% yield alongside Kraken’s DeFi Earn debut in January. Kraken itself launched Babylon-powered native BTC staking in June 2025, a Bitwise covered call strategy for institutional clients in February, and AVAX staking last week.
Long-term BTC holders represent one of the largest pools of idle capital in crypto, and exchanges that can convert holders into yield earners stand to gain significant retention and revenue advantages. Kraken’s Fed master account, Krak debit card, and now Bitcoin Vault collectively position the company as a full-stack financial platform rather than a pure-play exchange.
But the demand does not erase the risk surface. DeFi has lost over $1 billion to exploits in 2026. April was the worst month for crypto hacks in history by incident count. May has continued the trend. The man who literally co-founded the industry’s most trusted smart contract security library told the world today that the entire sector is unsafe.
Kraken’s Bitcoin Vault may be well-constructed, well-managed, and well-timed for user demand. Whether it is well-timed for DeFi’s current security environment is a different question — and one that each depositor will have to answer for themselves.
