JPMorgan highlights DeFi's institutional limitations due to persistent security risks

According to JPMorgan, the appeal of decentralized finance (DeFi) to institutional investors is being hindered by persistent security flaws and stagnant total value locked (TVL). TVL, which measures the total value of crypto assets deposited in DeFi protocols, is a key indicator of the ecosystem's size, usage, and overall health. The recent KelpDAO exploit, resulting in a $20 billion loss in TVL, has exposed significant structural risks. This incident involved an attacker breaching a cross-chain bridge, minting unbacked tokens, and using them as collateral to drain lending protocols, ultimately leaving approximately $200 million in bad debt. The far-reaching impact of this exploit highlights the interconnected nature of DeFi and its potential to amplify shocks. In response to such security breaches, crypto participants are increasingly seeking refuge in stablecoins, much like traditional investors turn to cash during uncertain times. The report notes that hacks and exploits pose a significant risk to the crypto industry, as they directly undermine trust in code-based systems. Smart contract bugs, phishing, and cross-chain bridge flaws can expose large pools of assets, often requiring attackers to exploit just one weak point to trigger substantial losses. The complexity and interconnectedness of blockchain infrastructure amplify these vulnerabilities, with cross-chain bridges being a particular concern due to their complicated designs and sometimes weak validation mechanisms. Repeated exploits erode confidence across the ecosystem, driving users and institutions away, prompting stricter regulation, and slowing adoption. As a result, security remains a fundamental constraint on crypto's growth. Despite gains in smart contract auditing, the report observes that hack losses this year are comparable to 2025 levels, with infrastructure and bridge exploits remaining the primary vulnerability. Furthermore, growth in DeFi remains muted, with TVL partially recovering in dollar terms but remaining largely unchanged in terms of ether (ETH). This suggests limited organic expansion and raises questions about DeFi's ability to scale for institutional use. In times of stress, investors continue to favor stablecoins, with capital flowing from DeFi lending into assets like Tether's USDT, which benefits from deeper liquidity and faster off-ramps.