Decentralized finance (DeFi) faces hurdles in its development. JPMorgan said security vulnerabilities and stagnant Total Value Locked (TVL) have limited institutional investor interest in the sector.
In a report sent to clients on April 23, 2026, US Bank analysts led by Nikolaos Panigirtzoglou noted: Recent attacks have exposed structural weaknesses in the ecosystem, impacting confidence and causing capital outflows.
Experts emphasize changes in the behavior of capital. “Just as traditional investors turn to cash during times of uncertainty, participants in the crypto world are responding to recent attacks by taking refuge in stablecoins,” they noted. This move strengthens the role of stablecoins as a defensive alternative within the ecosystem.
Despite advances in smart contract auditing, the JPMorgan report highlights that vulnerabilities still exist. Especially in complex infrastructures such as interchain bridges.expanding not only the functionality of the ecosystem but also its attack surface.
“This raises questions about whether DeFi can achieve the substantive growth needed to support broader institutional adoption,” they concluded.
One of the most relevant recent incidents is the hacking of the Kelp DAO protocol that occurred on April 18th. This attack exploited the following vulnerabilities: bridge between chainsAs reported by CriptoNoticias, this enabled the minting of approximately $292 million of rsETH tokens (Liquid Restored Ether) without any backing.
these assets Used as collateral to withdraw ETH on Aave, resulting in $292 million in debt.
And the impact was not limited to the affected protocols. “This incident shows that DeFi interconnections can be a weakness in the event of an adverse event, causing capital outflows from funds not directly exposed to the compromised assets,” the analysts said.
This is reflected in market data. DeFi ecosystem records $7.48 billion in outflows in 24 hours after Kelp DAO bridge hack. This means that even though some investors did not have funds in Kelp DAO, they withdrew their funds from other protocols out of fear.
TVL, which measures the total amount of assets deposited in DeFi protocols between April 18th and 23rd, Sales decreased by 15% from $99.52 billion to $84.585 billion.
Note that the Kelp DAO hack is not a special case. On April 1st, Drift Protocol was attacked, resulting in nearly $280 million in losses.
Since the Drift attack, at least 12 additional security incidents have been recorded in the cryptocurrency ecosystem.
(Tag translation) Aave (ETHLend)
