Security Weaknesses Continue to Limit DeFi's Appeal to Institutions, JPMorgan Warns

According to JPMorgan, the persistence of security vulnerabilities in decentralized finance (DeFi) is hindering its appeal to institutional investors. The total value locked (TVL) in DeFi protocols, a key metric for assessing the ecosystem's size and health, has been impacted by the KelpDAO exploit, which resulted in a $20 billion loss. This incident exposed the structural risks associated with cross-chain bridges and the potential for contagion across the DeFi ecosystem. In response to such exploits, crypto investors are increasingly seeking refuge in stablecoins, mirroring the traditional investor behavior of shifting to cash during uncertain times. The JPMorgan report notes that hacks and exploits remain a significant risk for the crypto industry, as they can directly undermine trust in systems that rely on code rather than intermediaries. The complexity and interconnectedness of blockchain infrastructure amplify these vulnerabilities, with cross-chain bridges being a particular weak point. Repeated exploits can erode confidence in the ecosystem, driving users and institutions away, and prompting stricter regulation. Despite some gains in smart contract auditing, hack losses this year are tracking 2025 levels, with infrastructure and bridge exploits remaining the primary vulnerability. The report also highlights that growth in DeFi remains muted, with TVL largely unchanged in terms of ether (ETH), suggesting limited organic expansion and raising questions about DeFi's ability to scale for institutional use. In times of stress, investors continue to rotate into stablecoins, such as Tether's USDT, which benefits from deeper liquidity and faster off-ramps, reinforcing its role as a preferred flight-to-safety asset.