Persistent decentralized finance exploits and weak growth are continuing to limit institutional interest in the DeFi sector, according to JPMorgan analysts.

The recent major hack linked to Kelp DAO has already wiped around $20 billion from DeFi's total value locked (TVL) in the span of just a few days, JPMorgan analysts led by managing director Nikolaos Panigirtzoglou said in a Wednesday report.

The attack involved a cross-chain bridge exploit, in which an attacker minted $292 million in unbacked rsETH tokens and used them as collateral on the lending protocol Aave to borrow real ETH, creating an estimated $230 million in bad debt.

"The incident triggered outflows from pools with no direct exposure to the compromised asset, showing that DeFi's interconnectedness can be a weakness during adverse events," the JPMorgan analysts said.

LayerZero and blockchain security researchers have linked the exploit to North Korea's Lazarus Group. Some of the stolen funds have since been frozen, while the remaining funds are still being moved across wallets and routed through privacy protocols.

Overall, crypto losses due to hacks and exploits so far this year are tracking at a pace similar to 2025, the JPMorgan analysts noted. They added that while the industry has improved smart contract auditing, challenges around bridge security remain.

Growth in DeFi also remains weak in ETH terms, the analysts said. In dollar terms, DeFi TVL has followed a similar path to the broader crypto market, rising sharply until 2021, falling in 2022, and then slowly recovering. However, in ETH terms, which adjusts for price changes, TVL has remained largely flat, the analysts said.

"This raises questions about the future of DeFi and whether DeFi can achieve the organic growth needed to support broader institutional adoption," they said.

Flight to safety

The analysts further said that recent exploits appear to drive a shift toward stablecoins, similar to how traditional investors move to cash during uncertain periods.

"DeFi participants tend to favor USDT, drawn by Tether's deeper liquidity across centralized exchanges and the more immediate off-ramp it offers during periods of on-chain stress. In other words, USDT appears to be the preferred flight-to-safety vehicle for rapid exits from on-chain positions. That said, this apparent advantage has yet to be reflected in USDT market cap growth," the analysts said.

"In all, persistent security vulnerabilities and a stagnant TVL continue to limit DeFi's institutional appeal, while each successive exploit reinforces a flight-to-safety pattern that tends to favor Tether's USDT," they concluded.

Separately, onchain analytics firm CryptoQuant said in a Wednesday report that the Kelp DAO exploit has triggered a sharp liquidity crunch across the DeFi sector, with borrowing rates surging.