DeFi's Institutional Appeal Limited by Persistent Security Risks, Says JPMorgan

According to JPMorgan, the presence of persistent security flaws is hindering the growth of decentralized finance (DeFi) and deterring institutional investors. The total value locked (TVL) in DeFi protocols, a key metric for measuring the ecosystem's size and health, has been stagnant. A significant exploit, such as the KelpDAO breach, which resulted in a $20 billion loss, exposes the structural risks inherent in DeFi. This incident involved an attacker breaching a cross-chain bridge, minting unbacked tokens, and using them as collateral to drain lending protocols, leaving behind approximately $200 million in bad debt. The ripple effects of such exploits can spread beyond the directly affected platforms, demonstrating how DeFi's interconnected nature can amplify shocks. In response to these security risks, crypto participants are increasingly seeking refuge in stablecoins, much like traditional investors shift towards cash during uncertain times. The analysts at JPMorgan pointed out that hacks and exploits pose a significant risk to the crypto industry, as they directly erode trust in systems that rely on code rather than intermediaries. Smart contract bugs, phishing, and cross-chain bridge flaws can expose large pools of locked assets, allowing attackers to exploit a single weak point and trigger substantial losses. The complexity and interconnectedness of blockchain infrastructure amplify these vulnerabilities. Cross-chain bridges, in particular, increase the attack surface and have been responsible for billions of dollars in losses due to their complicated designs and weak validation mechanisms. Repeated exploits can erode confidence across the ecosystem, driving users and institutions away, prompting stricter regulation, and slowing adoption. As a result, security has become a foundational constraint on crypto's growth. The bank's analysts noted that hack losses this year are similar to those in 2025, with infrastructure and bridge exploits remaining the primary vulnerability despite improvements in smart contract auditing. Furthermore, growth in DeFi remains muted, with TVL partially recovering in dollar terms but remaining largely unchanged in terms of ether (ETH). This suggests limited organic expansion and raises questions about DeFi's ability to scale for institutional use. In times of stress, investors continue to rotate into stablecoins, with capital flowing from DeFi lending into Tether's USDT, which benefits from deeper liquidity and faster off-ramps, reinforcing its role as a preferred flight-to-safety asset.