JPMorgan Says DeFi Exploits Still Block Institutional Adoption

• JPMorgan said persistent DeFi exploits and weak ETH-denominated TVL growth continue to limit institutional appeal. 
• The bank said the KelpDAO exploit wiped about $20 billion from DeFi TVL within days.
• A BIS paper published the same day said large crypto service providers increasingly resemble financial intermediaries. 

JPMorgan said repeated DeFi exploits and stagnant growth continue to curb institutional interest in the sector, with the latest KelpDAO breach reinforcing concerns about security, contagion, and capital efficiency. According to reports on the bank’s latest note, analysts led by Nikolaos Panigirtzoglou said the recent exploit erased about $20 billion from DeFi’s total value locked within days. 

The bank said the KelpDAO incident exposed structural weakness rather than a narrow protocol problem. The exploit allegedly allowed an attacker to mint about $292 million in unbacked rsETH, use it as collateral on Aave, and create an estimated $200 million to $230 million in bad debt, with spillovers hitting pools that had no direct exposure to the compromised asset. 

The firm said JPMorgan now agrees that security remains the key blocker to institutions coming on-chain. The post framed the issue in direct commercial terms, arguing that whoever solves the security problem is likely to unlock the next major wave of institutional growth. 

JPMorgan Says TVL Growth Still Looks Weak in ETH Terms

JPMorgan also argued that DeFi’s growth profile remains less impressive than it appears in dollar terms. The bank said TVL has recovered alongside the broader crypto market when measured in dollars and stayed largely flat when measured in ETH, which strips out part of the price effect and offers a cleaner read on organic expansion. 

That distinction matters for institutional investors. On one hand, dollar-based TVL can rise with token prices. On the other hand, flat ETH-denominated TVL suggests DeFi is not attracting enough new capital or usage to prove deeper structural growth. According to the bank, that raises fresh questions about whether the sector can scale in a way that supports lasting institutional participation. 

Stablecoin Rotation Adds Another Layer to the Stress Signal

JPMorgan said recent exploits have also reinforced a flight-to-safety pattern during periods of on-chain stress. According to the note, DeFi users tend to favor Tether’s USDT when risk rises, largely because it offers deeper liquidity across centralized exchanges and a more immediate exit route from on-chain positions. 

However, the bank noted that this perceived advantage has not yet translated into major USDT market cap growth. Even so, the behavior itself matters. It suggests that when DeFi confidence breaks, capital often moves toward more liquid and easier-to-exit instruments rather than staying inside protocol-native structures. 

BIS Adds a Broader Regulatory Warning

The JPMorgan warning landed the same day the Bank for International Settlements published a paper saying major cryptoasset service providers have evolved far beyond basic trading platforms and custodians into broader financial intermediaries. 

The BIS said the largest firms now offer products such as earn programs, lending, derivatives, and token issuance, often without prudential safeguards comparable to those applied in traditional finance. 

JPMorgan is warning that repeated exploits and weak organic growth keep institutions cautious, while the BIS is warning that crypto firms are taking on more bank-like risks without equivalent protections. For DeFi, the message is increasingly hard to avoid: security is no longer just a technical issue. It is becoming the central adoption issue.

Related: KelpDAO Attacker Moves 75,700 ETH Worth $175M in Three Transactions