Even as cryptocurrency adoption becomes more widespread through stablecoins and tokenized assets, security exploits are weighing on institutional appetite for decentralized finance (DeFi).
In an April research note, JPMorgan analysts said bridge security remains a challenge for the industry, raising questions about whether DeFi can grow to support further institutional adoption.
The recent exploit against the Versus-Ethereum bridge marks the eighth major attack on a DeFi bridge so far in 2026, with cumulative losses totaling $328.6 million.
DeFi bridges remain a prime target for hackers looking to steal millions of dollars. source: PeckShield
Misha Putiatin, CEO of smart contract security company Statemind and co-founder of DeFi protocol Symbiotic, said he regularly receives calls from major traditional institutions exploring DeFi exposure, but the timing is often bad.
“Five minutes before I was on the phone with a large traditional institution, another big hack happened,” he told Cointelegraph.
“They look at me and ask, ‘Is this normal? Does this happen every day?'”
Institutions may nevertheless enter DeFi, but the conditions under which they arrive may be reshaped into something much more similar to traditional finance than the open, permissionless system envisioned by its developers.
DeFi has become too complex for DYOR.
In early April, North Korea’s Lazarus Group was implicated. $285M Drift Protocol ExploitThis was accomplished through a months-long social engineering campaign in which the intruder reached out to Drift contributors. In-person cryptocurrency conference.
They were the same actors Accusations of KelpDAO Violation A few weeks later, approximately $290 million was consumed on the protocol’s cross-chain bridge.
The total value locked across DeFi fell from less than $100 billion to about $86 billion in the two days following the KelpDAO hack in April. JPMorgan analysts said the outflows occurred in pools that were not directly exposed to the compromised assets.
DeFi pools lost approximately $14 billion after the KelpDAO attack. source: Dipilama
relevant: Wall Street’s Tokenization Boom Has Liquidity Problems: Axis CEO
Putiatin said the complexity of modern DeFi makes it nearly impossible for the average user to know where the risks actually lie. “Doing your own research no longer works,” he said. “It hasn’t worked for a really long time.”
He explained that systems have become too interconnected and complex to keep track of.
For example, if a user deposits Ether (ETH) to earn a return and never touches any other tokens, they could get breached by a bridge connected to a token they have never heard of.
DYOR is an industry mantra born in the early days of Bitcoin when the protocol was simple enough for users to read whitepapers and make informed decisions.
Today, with smart contracts running up to tens of thousands of lines of code, protocols overlapping each other, and new services and tokens being released at breakneck speed, meeting these expectations has become nearly impossible.
“We don’t expect people who just want to invest money to figure out every part of the stack themselves,” Putiatin said.
“I’m not going to try to figure out how to get a 6% return over the next two years,” he added. He argued that DeFi’s security risks are close enough to traditional financial alternatives that they make little sense to most investors.
Reduce premiums for unquantifiable risks
Tether (USDT), the world’s largest stablecoin, offers a supply APY of 2.74% on the Ethereum marketplace on Aave, the largest DeFi lending protocol. that below 3.57% available on 3-month U.S. Treasury bonds. Circle’s USDC (USDC) is better at 4.14%.
Supply and borrow APY on Aave’s Ethereum marketplace. source: ghost
relevant: Why stablecoins and SWIFT should coexist
Putiatin said institutions are seeing this clearly, even if they have difficulty quantifying it precisely. The problem is that there is no reliable framework for institutions to price the risk of being hacked.
“They can’t properly price risk,” he said. “So they discount a lot of the returns that we offer.”
As markets mature, DeFi returns have compressed, eroding the premiums that once justified the risk.
At the same time, hacking speeds have not slowed down. For investors accustomed to underwriting risk through actuarial precision, narrowing the upside and unquantifiable downside can be difficult.
How much does DeFi cost to have a seat at the table?
Putiatin’s benchmark, when DeFi has truly turned a corner, is an on-chain insurance system that can underwrite hacking risks across the entire ecosystem and price them with the exact actuarial precision that institutions demand.
“Having a circuit breaker, a curator who can do the due diligence and a framework to do that will give us the fourth that we so desperately need as an industry,” he said. “I’ll take out insurance.”
According to DeFiLlama, DeFi lost over $7.76 billion due to exploits. data It dates back to 2016. DeFi insurance providers exist, but their capabilities are too small to prevent anything approaching institutional scale.
Without that infrastructure in place, participating institutions will be on their own, requiring full know-your-customer verification, custody controls, and tokens that can be frozen at any time.
The open, permissionless architecture that made DeFi worth building on is eliminated to meet compliance requirements.
“All the advantages we have as an industry are being lost,” he said. “Blockchain becomes simply a database.”
Putiatin believes this is more of a problem than the hack itself. At least hacking is a problem the industry can solve. A version of DeFi that has been hollowed out to make it secure enough for institutions to carry out their missions abandons everything that the technology needed to change.
magazine: 5 technology predictions the mainstream media got terribly wrong