JPMorgan published a report that delivers a sobering assessment of the DeFi sector. The research team under Managing Director Nikolaos Panigirtzoglou argues that frequent security incidents and a stagnant Total Value Locked (TVL) continue to constrain institutional interest in DeFi.
The analysis comes from the major bank, which manages roughly 4.8 trillion USD in AUM. Moreover, it lands during a period of heightened nervousness in the on-chain credit market. JPMorgan puts the total losses from DeFi exploits in April 2026 at more than 600 million USD within three weeks. Furthermore, the DeFi TVL measured in Ether (ETH) remains largely flat, even though dollar values have partially recovered alongside broader crypto prices. As a result, the bank reads this finding as an indication that underlying activity is not growing, despite rising token prices.
Subscribe to our newsletter
The best articles of the week, directly delivered into your mailbox.
KelpDAO exploit as the central case study
On 19 April 2026, an attacker exploited a cross-chain bridge at KelpDAO. Subsequently, he minted unbacked rsETH tokens worth roughly 292 million USD. The attacker then deposited these tokens as collateral on Aave to borrow real ETH. As a result, roughly 230 million USD in bad debt remained on the largest DeFi lending protocol. Within a few days, the incident triggered withdrawals of 15 billion USD from DeFi TVL.
The chain reaction highlights the fragility of the infrastructure. In the 24 hours following the hack, large investors pulled more than 6 billion USD from Aave. Furthermore, the Aave V3 USDC pool ran at 99.87 percent utilization for days, with less than 3 million USD in free liquidity available. Users borrowed roughly 300 million USD against their own locked stablecoin deposits at significantly elevated costs. Therefore, the pattern matches a classic bank run, only in an accelerated on-chain form.
LayerZero and external security researchers identified North Korea's Lazarus Group as the suspected attacker. Part of the stolen funds appears frozen, while the remainder moves through wallets and privacy protocols. In the report, JPMorgan explicitly names cross-chain bridges as the segment with the highest concentration of unresolved risk. So far, progress in smart contract auditing has not contained bridge attacks. In addition, restaking protocols like KelpDAO compound the problem because they stack multiple token derivatives on top of each other, and each layer creates a new attack surface.
Liquidity crunch and rate spike on Aave
The consequences of the exploit showed up immediately in borrowing rates. USDT and USDC borrowing rates on Aave V3 jumped from roughly 3.4 percent to around 14 percent. As a result, borrowing stablecoins for hedged on-chain strategies briefly became unprofitable. Circle's Chief Economist Gordon Liao described the market after the incident as "broken," because the existing rate model on Aave failed to attract new suppliers. Moreover, the rate spike acted as direct margin pressure on basis trades and delta-neutral stablecoin strategies, which attract the strongest demand in institutional settings.
At the same time, JPMorgan observes a capital rotation into stablecoins as a flight-to-safety move. After the exploit, capital flowed increasingly into USDT, preferred for its better liquidity and faster off-ramps on centralized exchanges. However, this increase has not yet translated into measurable growth in USDT market capitalization. Whether it represents a pure reshuffling of existing positions remains open.
"Just as traditional investors rotate into cash during uncertain times, crypto participants have sought refuge in stablecoins following recent exploits. USDT appears to be the preferred flight-to-safety vehicle for quick exits from on-chain positions." - Nikolaos Panigirtzoglou, JPMorgan report
The dynamics on Aave itself stand out. The protocol recorded a TVL drop of 8.45 billion USD to 18 billion USD in the wake of the exploit. At the same time, total DeFi TVL fell from 100 billion USD to 86 billion USD. By the end of April 2026, the figure stands at around 82.4 billion USD, the lowest level in a year. Compared with early 2026, this represents a decline of roughly 25 percent. Measured against the peak of 171.9 billion USD in October 2025, the sector has lost more than half of its locked value.
Series of exploits weighs on trust
The KelpDAO incident is not an isolated case. In early April 2026, Drift Protocol lost roughly 285 million USD through an exploit that primarily affected the derivatives segment on Solana. Additional smaller incidents at Resolv Labs, Hyperbridge, and Rhea Finance pushed total losses over three weeks past 600 million USD. Moreover, JPMorgan notes that hack losses in 2026 are tracking at a level similar to 2025. A structural improvement has not yet emerged, even though the industry has invested for years in audits, bug bounties, and formal verification.
The historical context reinforces the bank's assessment. DefiLlama counted roughly 6 billion USD in rug-related TVL losses across the entire DeFi ecosystem in 2025. In February 2026, ZeroLend collapsed 98 percent following a depegging cascade. Ethereum continues to dominate infrastructure with roughly 68 percent of total DeFi TVL, while Solana has risen to the second-largest DeFi hub with around 9.2 billion USD in TVL. In addition, the concentration in a few large protocols such as Aave, Lido, and EigenLayer further amplifies contagion risk.
In 2025, individual DeFi segments did reach notable figures. Perpetual DEX volume rose 346 percent to an all-time high of 6.7 trillion USD. For example, Real World Assets and Prediction Markets grew 139 percent and 233 percent, respectively. At the same time, classic DEX, derivatives, and farm segments shrank, and most large-cap L1 tokens closed the year with flat or negative performance. Therefore, dollar TVL suggests growth while ETH-denominated TVL stagnates.
Why ETH-denominated TVL matters for institutions
For JPMorgan, ETH-denominated TVL is not a technical detail but the most meaningful indicator of activity. If dollar TVL rises only because the ETH price appreciates, real protocol usage remains unchanged. Flat TVL in ETH terms means no new users and no additional locked assets. For institutional allocators, this is precisely the benchmark, because it separates organic demand for DeFi services from pure valuation effects.
In parallel, the sector lacks the safeguards that traditional financial markets take for granted. There is no deposit insurance, no binding stress tests, and only a fragmented insurance market. Providers such as Nexus Mutual typically cover less than 1 percent of total DeFi TVL. Under these conditions, a treasurer at a major bank or a pension fund cannot deploy meaningful capital, even if yields were attractive.
JPMorgan draws a clear conclusion. Large institutions will remain cautious until DeFi can demonstrate sustained improvements in security, risk management, and insurance mechanisms. Without institutional inflows, the sector lacks the capital base that traditional financial institutions would bring for market making, lending, and structured products. Therefore, the combination of recurring bridge exploits, stagnant activity in ETH terms, and fragile liquidity management on the largest lending protocols argues against a near-term reversal.
