JPMorgan: DeFi Exploits and Stagnant TVL Continue to Limit Institutional Adoption

Gate News message, April 23 — JPMorgan analysts say persistent decentralized finance exploits and weak growth continue to limit institutional interest in the sector. The recent Kelp DAO attack wiped approximately $20 billion from DeFi’s total value locked (TVL) in just days, according to a report led by JPMorgan managing director Nikolaos Panigirtzoglou.

The exploit involved a cross-chain bridge vulnerability where an attacker minted $292 million in unbacked rsETH tokens and used them as collateral on Aave to borrow real ETH, creating an estimated $230 million in bad debt. LayerZero and blockchain security researchers linked the attack to North Korea’s Lazarus Group. Some stolen funds have been frozen, while the remainder continues to be moved across wallets and routed through privacy protocols. The incident triggered outflows from pools with no direct exposure to the compromised asset, demonstrating how DeFi’s interconnectedness can become a weakness during adverse events.

In ETH terms, DeFi TVL has remained largely flat despite rising in dollar terms through 2021, falling in 2022, and slowly recovering thereafter. JPMorgan analysts noted that crypto losses from hacks and exploits in 2026 are tracking at a pace similar to 2025, though the industry has improved smart contract auditing. “Persistent security vulnerabilities and stagnant TVL continue to limit DeFi’s institutional appeal,” they said.

The analysts also observed a flight-to-safety pattern favoring stablecoins, particularly USDT, during periods of on-chain stress. CryptoQuant separately reported that the Kelp DAO exploit triggered a sharp liquidity crunch across DeFi, with borrowing rates surging.