According to JPMorgan, ongoing security flaws combined with stagnant total value locked (TVL) are diminishing the appeal of decentralized finance (DeFi) for institutional investors. TVL, which measures crypto assets deposited in DeFi protocols, is a key indicator of the ecosystem’s size and health.
TheKelpDAO exploit notably reduced approximately $20 billion from TVL within days, highlighting significant structural vulnerabilities. An attacker compromised a cross-chain bridge to mint $292 million worth of unbacked rsETH, using it as collateral in lending platforms before leaving behind about $200 million in bad debt. This event showcased how interconnected DeFi systems can magnify disruptions across the network.
“In times of uncertainty, much like traditional investors who turn to cash, crypto participants have sought refuge in stablecoins,” stated Nikolaos Panigirtzoglou and his team in their Wednesday report.
Security breaches continue to pose a fundamental risk in the crypto space by eroding trust in systems dependent on code rather than intermediaries. Flaws within smart contracts, phishing attempts, and weaknesses in cross-chain bridges can expose significant amounts of locked assets, with attackers often needing to exploit only one vulnerability to cause substantial losses.
The complexity and interconnectedness inherent to blockchain infrastructure exacerbate these risks. Cross-chain bridges enhance functionality but also expand the attack surface, having led to billions in losses due to their intricate designs, shared infrastructures, and sometimes inadequate validation processes.
Repeated security incidents undermine confidence within the ecosystem, potentially driving users and institutions away, prompting tighter regulations, and slowing adoption rates. These factors make security a critical barrier to crypto’s growth.
JPMorgan analysts observed that hacking losses this year are comparable to 2025 levels, with infrastructure and bridge exploits remaining predominant despite improvements in smart contract audits.
Growth has also been tepid. Although TVL has shown some recovery in dollar terms, it remains largely unchanged when measured in ether (ETH), signaling limited organic growth and raising doubts about DeFi’s scalability for institutional purposes, according to the report.
During periods of stress, investors are seen moving into stablecoins like Tether’s USDT, which offers deeper liquidity and quicker exit options. This trend was evident following the exploit, as capital shifted from DeFi lending platforms to USDT, underscoring its role as a preferred safe-haven asset.