Security vulnerabilities remain a major hurdle for institutional investors considering the decentralized finance (DeFi) sector. Despite these challenges, the adoption of cryptocurrencies continues overall, buoyed by stablecoins and the digitization of assets. Analysts at JPMorgan recently highlighted that unresolved bridge security issues are a persistent concern, and it remains unclear if institutional investors will ramp up their engagement with DeFi in the coming period.
Major attacks surge in 2026
The recent breach of the Versus-Ethereum bridge marks the eighth significant DeFi bridge hack since the start of 2026, with total losses reaching $328.6 million. These bridges, designed for transferring substantial funds across networks, remain prime targets for cyber attackers seeking high-profile rewards.
Glossary: A DeFi bridge is a smart contract that enables asset transfers between different blockchain networks. While they provide cross-chain liquidity, their complexity can expose them to sophisticated cyberattacks.
In April, investigators traced a $285 million drift protocol exploit to the North Korea-linked Lazarus Group. Similarly, KelpDAO’s cross-chain bridge lost roughly $290 million in a comparable incident.
| Year | Protocol | Losses (Million $) |
|---|---|---|
| 2026 | Versus-Ethereum | 328.6 |
| 2026 | Drift Protocol | 285 |
| 2026 | KelpDAO | 290 |
Following the KelpDAO exploit, total value locked in DeFi platforms dropped from $100 billion to $86 billion in just two days. According to JPMorgan analysts, these outflows occurred even in projects untouched by the attacks. Data from DefiLlama confirmed that $14 billion exited the sector after the incident.
Complex risk environment challenges traditional finance
Misha Putiatin, CEO of smart contract security firm Statemind and co-founder of DeFi protocol Symbiotic, notes that large institutional investors consistently seek insights into DeFi. However, he observes that hacks frequently occur just as talks with these investors are underway, exacerbating hesitation due to security issues inherent in the sector.
Putiatin emphasized that as DeFi becomes increasingly complex, users can no longer realistically assess all potential risks. “In the early days, ‘do your own research’ worked, but with networks and smart contracts becoming deeply intertwined, this is now nearly impossible,” he explained.
Modern DeFi protocols comprise tens of thousands of lines of code and rapidly integrate new offerings. As Putiatin points out, this makes it extraordinarily difficult for investors to weigh risks against the potential rewards in DeFi.
Returns shrink, risk premiums fall
Despite the alarming rise in DeFi attacks, returns on DeFi platforms have shrunk dramatically. For example, Tether’s (USDT) annual yield on Aave is 2.74%, while U.S. Treasury bills offer 3.57% on short-term bonds. Circle’s USD Coin (USDC) meanwhile provides a 4.14% yield. These figures reveal a narrowing spread between DeFi risks and rewards.
| Asset | DeFi Yield (APY, %) | US Treasury (3 months, %) |
|---|---|---|
| Tether (USDT, Aave) | 2.74 | 3.57 |
| USD Coin (USDC, Aave) | 4.14 | 3.57 |
According to Putiatin, institutional investors now heavily discount DeFi’s annual yields because they cannot easily assess the balance of risk and reward. As the industry matures and outsized returns fade, DeFi has become less appealing to institutions that rely on sophisticated actuarial risk calculations.
Insurance shortfalls and a sector crossroads
Putiatin argues that on-chain insurance protocols are essential if DeFi is to win institutional trust. He believes emergency shutdown mechanisms, compliance-focused audits, and systematic risk monitoring could deliver the security institutions demand. However, he also notes that today’s DeFi insurance services are not robust enough to cover institutional-scale losses.
Putiatin states that, at present, institutional investors may only enter the sector if there are stringent identity checks, custodial safeguards, and token freeze functionality in place—a requirement that, in his view, could undermine the decentralized essence of DeFi and reduce blockchains merely to databases.
DefiLlama reports total DeFi hack losses now exceed $7.76 billion. Experts caution that without effective insurance and protection frameworks, institutional participation will remain limited and subject to strict regulatory conditions.
