Security exploits are increasingly weighing on institutional appetite for decentralized finance (DeFi), even as broader crypto adoption continues through stablecoins and tokenized assets. According to an April research note from JPMorgan analysts, bridge security remains a persistent challenge for the industry, raising questions about whether DeFi can grow to support further institutional adoption.
The recent exploit on the Versus-Ethereum bridge marks the eighth major attack against DeFi bridges in 2026 so far, with cumulative losses totaling $328.6 million. These figures underscore the systemic vulnerability of cross-chain bridges, which remain prime targets for hackers seeking to steal millions of dollars in a single breach.
Misha Putiatin, CEO of smart contract security firm Statemind and co-founder of DeFi protocol Symbiotic, said he regularly fields calls from major traditional institutions exploring DeFi exposure, often with bad timing. "Five minutes before I have a call with a big traditional institution, another big hack," he told a crypto news outlet. "They sit there looking at me like, 'Is this normal? Is this every day for you?'"
DeFi has become too complex for DYOR
In early April, North Korea's Lazarus Group was implicated in the $285 million Drift Protocol exploit, carried out through a months-long social engineering campaign where infiltrators approached Drift contributors at an in-person crypto conference. The same actors were blamed for the KelpDAO breach a few weeks later, which drained about $290 million from the protocol's cross-chain bridge.
Total value locked across DeFi fell from just under $100 billion to around $86 billion in two days following the KelpDAO hack. The outflows came from pools with no direct exposure to the compromised assets, JPMorgan analysts noted. This illustrates a critical risk: DeFi's interconnectedness means a single exploit can trigger widespread withdrawals across unrelated protocols.
Putiatin said the complexity of modern DeFi makes it nearly impossible for ordinary users to know where their risk actually sits. "Do your own research doesn't work anymore. It hasn't been working for a really long time," he explained. The system has become too interconnected and complex to trace. For example, when a user deposits Ether (ETH) to earn yield without ever touching any other token, they can still suffer losses from a breach on a bridge connected to an obscure token they've never even heard of.
The mantra of "do your own research" (DYOR) was born in Bitcoin's early days, when protocols were simple enough that a user could read a whitepaper and make an informed decision. Today, with smart contracts running tens of thousands of lines of code, protocols layered on top of one another, and new services and tokens launching at breakneck speed, that expectation has become almost impossible to meet. "I'm not ever expecting people that just want to invest their money to ever figure out every part of the stack themselves," Putiatin said, adding that he wouldn't spend two years of his life trying to secure a 6% yield when traditional finance offers comparable returns with far less complexity.
A shrinking premium for an unquantifiable risk
Tether (USDT), the world's largest stablecoin, currently offers a supply APY of 2.74% on Aave's Ethereum market, the leading DeFi lending protocol. That rate is below the 3.57% available on a three-month US Treasury bill. Circle's USDC (USDC) fares slightly better at 4.14%, but still barely exceeds risk-free government securities when factoring in operational and security risks.
Putiatin noted that institutions see this imbalance clearly, even if they struggle to quantify it precisely. The core problem is that institutions have no reliable framework for pricing the hack risk hidden beneath DeFi yields. "They can't price risk properly. So they discount the yield we provide by a lot," he said.
DeFi yields have compressed as the market matured, eroding the premium that once justified the risk. Meanwhile, hacks have not slowed down. For investors accustomed to underwriting risk with actuarial precision, shrinking upside coupled with unquantifiable downside is a hard sell. The gap between DeFi yields and traditional fixed-income products narrows further each year, making decentralized finance less attractive for yield-seeking institutions.
The cost of DeFi's seat at the table
Putiatin's benchmark for when DeFi has genuinely turned a corner is the emergence of an onchain insurance system capable of underwriting hack risk across the entire ecosystem and pricing it with the kind of actuarial precision that institutions demand. "When we have circuit breakers, curators that can do due diligence, and a framework for that — we will get the fourth one that we desperately need as an industry. We will get insurance," he said.
DeFi has lost over $7.76 billion to exploits, according to data tracking back to 2016. While DeFi insurance providers exist, their capacity remains far too small to backstop anything approaching institutional scale. Without such infrastructure, institutions that do enter the space will do so on their own terms—demanding full know-your-customer checks, custodial controls, and tokens that can be frozen at any time. The open, permissionless architecture that made DeFi worth building gets stripped away to satisfy compliance requirements.
"All of the benefits that we have as an industry, they kind of go away," Putiatin warned. "Blockchain becomes just a database." This outcome is more troubling to him than the hacks themselves. The hacks are a problem the industry can work on. But a version of DeFi that institutions have hollowed out to make it safe enough for their mandates represents a surrender of everything the technology was supposed to change. The industry faces a critical choice: develop robust risk frameworks and insurance mechanisms that preserve DeFi's core principles, or risk seeing its revolutionary potential diluted into a mere compliance-compliant data ledger.
Source: Cointelegraph News