JPMorgan states that ongoing security vulnerabilities and stagnant total value locked (TVL) continue to weaken institutional interest in DeFi. The report says that the KelpDAO breach wiped out about $20 billion in TVL within a few days, with attackers minting $292 million worth of uncollateralized rsETH through cross-chain bridges and using it as collateral to withdraw funds from lending protocols, resulting in approximately $200 million in bad debt. JPMorgan points out that this year's hacking losses are on par with 2025 levels, with infrastructure and cross-chain bridge vulnerabilities remaining the main risks; meanwhile, DeFi's TVL has partially recovered in USD terms but remained essentially unchanged in ETH terms, indicating limited organic growth. The report also states that after the incident, funds shifted from DeFi lending to USDT, reflecting investors' continued move toward stablecoins during stressful periods. (CoinDesk)