JPMorgan Says Security Flaws Curb DeFi's Institutional Appeal

Decentralized finance, or DeFi, uses smart contracts to provide lending, trading and yield-generating services, with total value locked, or TVL, serving as a key measure of capital in the sector. JPMorgan said interdependencies between cross-chain bridges and multilayered protocols can amplify a single point of failure. As DeFi's yield advantage narrows, difficult-to-quantify hacking risks are deterring institutional participation.

On April 18, 2026, liquid restaking protocol KelpDAO suffered a cross-chain bridge attack in which about $293 million in rsETH was stolen. Overall DeFi TVL fell by about $20 billion in the following days, though that was not a direct loss incurred by KelpDAO. JPMorgan said in an April 22 report that ETH-denominated TVL remained stagnant, while investors seeking safety shifted funds into Tether's USDT.