Flash loan attacks drained $1.211 billion from decentralized finance platforms between February 2020 and July 2024, according to research published in the Journal of Financial Crime.
The paper was written by University of Winchester professor Tim Hall and Remo Stieger, a former partner at Swiss risk intelligence firm SyntiFi. It identified 72 flash loan attacks among 254 successful attacks on DeFi during that period. Those 254 incidents caused $6.568 billion in losses in total, with flash loan exploits accounting for 18.44%.
Researchers say the crime pattern is unlike what came before
Hall said in a statement that 「we now are seeing crimes that we have never seen before」 and that some are 「capable of stealing mind-boggling sums of money, often in the tens of millions of dollars.」
Flash loans allow users to borrow assets from a liquidity pool without posting collateral, as long as the loan is repaid within the same blockchain transaction. Attackers use that structure to access the large sums needed to carry out an exploit.
The study found that more than 80% of flash loan attack losses took place on Ethereum. Individual attacks ranged from $80,000 to $197 million. Incidents that stole $10 million or more made up over 88% of total losses.
Four attack types made up more than 81% of losses
The researchers identified 14 forms of flash loan attack. They grouped them into two broad categories: attacks that manipulate price feeds and attacks that exploit flaws in a protocol's underlying logic. Logic exploits were less common, but they produced higher average losses.
According to the paper, logic exploits accounted for 28% of flash loan attack losses from February 2020 to January 2022. From February 2022 to July 2024, that share rose to 55%.
Four attack types accounted for more than 81% of losses: price oracle attacks, donate function logic exploits, reentrancy attacks, and a single governance attack. That governance incident alone cost $181 million.
Attack activity shifted through growth and consolidation phases
The authors wrote that flash loan attack activity moved through phases of growth and consolidation. In their view, that suggests platforms improved security after being hit, while attackers kept finding new vulnerabilities.
The study also drew on an interview with one platform that suffered a major flash loan attack. The platform was not named, at its request. A representative said the exploited bug had passed 「ourselves and several of the auditors」 and remained unnoticed on-chain for more than a year.
Hall said the attacker later began 「taunting」 the platform on social media. That, he said, 「led to some victims engaging with the attacker and outlining the devastating impacts that the loss of this money had on them.」
The platform representative divided attackers into 「hobbyist individual researchers」 and professional state-level or organized crime groups, specifically citing North Korea. From a blockchain security perspective, the representative said the professionals' attacks 「are not at all advanced.」
The same representative also described the toll on affected teams, saying that 「most often it ends up fracturing them and destroying them,」 even when funds are recovered.
The paper says flash loan attacks are serious, but not existential for DeFi
The study found that losses exceeded 0.5% of the value borrowed through flash loans in only one six-month period, even as flash loan usage itself kept growing.
The authors described the attacks as significant, increasingly sophisticated, and unpredictable, but 「not existential」 threats to DeFi.
After the study period ended, decentralized exchange Bunni shut down in October 2025 following an $8.4 million exploit that used flash loans. The project said it could not afford the cost of a secure relaunch.
Hall said: 「We are keen that this isn't seen just as a piece of academic research. The analysis we did has a host of applications for the cryptocurrency industry, for regulators and for legal and law enforcement agencies.」
