Jack Paul 
JPMorgan has pointed to persistent security flaws and stagnant total value locked (TVL) as key factors that are curbing decentralized finance’s (DeFi) appeal among institutional investors. TVL, which measures the value of crypto assets deposited in DeFi protocols, is widely seen as a benchmark for the ecosystem’s health and adoption.
The Wall Street bank highlighted the recent KelpDAO exploit as a stark example of the risks. That attack, which erased an estimated $20 billion in TVL in just a few days, exposed deep structural weaknesses. An attacker broke into a cross-chain bridge, minted $292 million in unbacked rsETH tokens, and then used them as collateral to drain lending protocols. The result was roughly $200 million in bad debt, and the damage spread beyond the directly affected platforms. This shows how DeFi’s interconnected systems can make shocks worse, not contain them.
According to analysts led by Nikolaos Panigirtzoglou, the response from investors has been telling. “Much as traditional investors shift towards cash in uncertain times, crypto participants have responded to recent exploits by seeking refuge in stablecoins,” they wrote in a Wednesday report.
Core vulnerabilities persist
Hacks and exploits remain a central problem for crypto because they directly attack the trust that users place in code rather than traditional intermediaries. Smart contract bugs, phishing schemes, and flaws in cross-chain bridges can expose large pools of locked assets. Often, attackers only need to find one weak point to trigger massive losses. These vulnerabilities are made worse by the sheer complexity of blockchain infrastructure. Cross-chain bridges, for example, expand what the network can do, but they also increase the attack surface. They’ve been responsible for billions in losses due to complicated designs, shared infrastructure, and sometimes weak validation methods.
Beyond the immediate financial hit, repeated exploits eat away at confidence across the whole ecosystem. Each major hack can push users and institutions away, invite stricter regulation, and slow down wider adoption. In that sense, security is a foundational constraint on how fast crypto can grow, JPMorgan argued.
Growth is flat, despite price gains
The bank’s analysts noted that hack losses this year are tracking similar to 2025 levels. Infrastructure and bridge exploits remain the top vulnerability, even though smart contract auditing has improved. Growth in DeFi remains muted, too. While TVL has partially recovered when measured in dollar terms, it is largely unchanged when measured in ether (ETH). That suggests limited organic expansion and raises real questions about DeFi’s ability to scale for institutional use, the report said.
During periods of stress, investors keep moving into stablecoins. After the exploit, capital flowed from DeFi lending into Tether’s USDT. That stablecoin benefits from deeper liquidity and faster off-ramps, reinforcing its role as a preferred safe-haven asset, according to JPMorgan.