JPM (JPM) has warned that persistent security vulnerabilities and stagnant total value locked (TVL) are negatively affecting the institutional appeal of decentralized finance (DeFi) due to these flaws. The bank stated that the KelpDAO exploit, which wiped out about $20 billion in TVL within days, exposed structural risks and led to a surge in TVl, which is often used as a gauge of the size, usage and overall health of the ecosystem. Despite gains in smart contract auditing, the bank's analysts noted that hack losses this year are tracking 2025 levels, with infrastructure and bridge exploits still the primary vulnerability. The growth of TVL has only partially recovered in dollar terms, suggesting limited organic expansion and raising questions about DeFi's ability to scale for institutional use.