JPMorgan: DeFi Security Exploits and Stagnant TVL Limit Institutional Adoption

Gate News message, April 23 — JPMorgan analysts led by managing director Nikolaos Panigirtzoglou said that persistent decentralized finance (DeFi) exploits and weak growth continue to limit institutional interest in the sector. The recent Kelp DAO hack wiped approximately $20 billion from DeFi’s total value locked (TVL) in just a few days, according to the Wednesday report.

The exploit involved a cross-chain bridge vulnerability in which an attacker minted $292 million in unbacked rsETH tokens and used them as collateral on the lending protocol Aave to borrow real ETH, creating an estimated $230 million in bad debt. LayerZero and blockchain security researchers linked the attack to North Korea’s Lazarus Group. Some stolen funds have been frozen on Arbitrum, while remaining funds continue to move across wallets and through privacy protocols. “The incident triggered outflows from pools with no direct exposure to the compromised asset, showing that DeFi’s interconnectedness can be a weakness during adverse events,” the analysts said.

Crypto losses from hacks and exploits this year are tracking at a pace similar to 2025, the JPMorgan analysts noted. In ETH terms, DeFi TVL has remained largely flat despite dollar-denominated growth, raising questions about organic growth and institutional adoption. The analysts observed that recent exploits appear to drive a shift toward stablecoins, with DeFi participants favoring USDT for its liquidity and rapid off-ramp capabilities during on-chain stress. “Persistent security vulnerabilities and a stagnant TVL continue to limit DeFi’s institutional appeal, while each successive exploit reinforces a flight-to-safety pattern that tends to favor Tether’s USDT,” they concluded.

Separately, onchain analytics firm CryptoQuant reported that the Kelp DAO exploit triggered a sharp liquidity crunch across the DeFi sector, with borrowing rates surging.