New Crime Is Way Up: Flash Loans Drained $1.2B From DeFi In One Quick Transaction

Flash loan attacks siphoned $1.211 billion from decentralized finance platforms between February 2020 and July 2024, according to research published in the Journal of Financial Crime. The study, authored by Professor Tim Hall of the University of Winchester and Remo Stieger, a former partner at Swiss risk intelligence firm SyntiFi, identified 72 flash loan attacks out of 254 successful DeFi exploits during the period. Those 254 incidents accounted for $6.568 billion in losses, with flash loan attacks representing 18.44% of the total.

Hall said in a statement that "we now are seeing crimes that we have never seen before," some "capable of stealing mind-boggling sums of money, often in the tens of millions of dollars." Flash loans allow users to borrow assets from a liquidity pool without collateral, provided the loan is repaid within the same blockchain transaction. Attackers use the instrument to access large sums needed to manipulate protocols in a single block.

More than 80% of flash loan attack losses occurred on Ethereum, the study found. Individual incidents ranged from $80,000 to $197 million, and attacks that stole $10 million or more accounted for over 88% of losses. The researchers identified 14 types of flash loan attack, grouped into two broad categories: those that manipulate price feeds and those that exploit flaws in a protocol's underlying logic. Logic exploits were less frequent but produced higher average losses, accounting for 28% of flash loan attack losses between February 2020 and January 2022, and 55% from February 2022 to July 2024.

Four attack types were responsible for more than 81% of losses: price oracle attacks, donate function logic exploits, reentrancy attacks, and a single governance attack that cost $181 million. The study drew on an interview with one platform that suffered a major flash loan attack, granted anonymity at its request, in which the team said the bug exploited had passed "ourselves and several of the auditors." The authors wrote that attack activity moved through phases of growth and consolidation, suggesting platforms improved security after incidents while attackers adapted to find new ones.