Flash loan attacks extracted $1.211 billion from decentralized finance platforms in 72 incidents between February 2020 and July 2024, according to research published in the Journal of Financial Crime and reported by Decrypt. The losses represented 18.44% of the $6.568 billion lost across 254 successful DeFi attacks during the same period.
How flash loans enable attacks
A flash loan allows a user to borrow digital assets from a liquidity pool without providing collateral, as long as the full loan is returned within the same blockchain transaction. The mechanism is designed to provide rapid access to large amounts of capital, but that same feature can give an attacker the funds needed to exploit weaknesses in a decentralized protocol.
The study was written by Tim Hall, a professor at the University of Winchester, and Remo Stieger, a former partner at Swiss risk intelligence firm SyntiFi. Their analysis found that more than 80% of the losses from flash loan attacks occurred on Ethereum.
Individual incidents caused losses ranging from $80,000 to $197 million. Attacks involving losses of at least $10 million made up more than 88% of the total amount stolen, showing that the overall damage was concentrated in a relatively small number of large incidents.
Professor Hall said the research examined crimes that had not previously been seen in the same form and included attacks capable of taking tens of millions of dollars. The authors described flash loan attacks as significant, increasingly sophisticated and unpredictable threats to DeFi, while saying they were not existential threats to the sector.
Price manipulation and protocol flaws
The researchers identified 14 forms of flash loan attack and grouped them into two broad categories. One involved manipulating price feeds, which protocols use to determine the value of assets. The other involved exploiting flaws in a protocol’s underlying logic.
Logic-based attacks occurred less often than price-feed attacks, but they produced larger average losses. Their share of flash loan losses rose from 28% between February 2020 and January 2022 to 55% between February 2022 and July 2024.
Four attack types accounted for more than 81% of all flash loan losses recorded in the study:
- Price oracle attacks
- Donate-function logic exploits
- Reentrancy attacks
- One governance attack that caused $181 million in losses
The change in the composition of attacks suggests that the security response of DeFi platforms and the behavior of attackers evolved during the period examined. As platforms addressed known weaknesses, attackers looked for other vulnerabilities, according to the research.
The study also found that losses exceeded 0.5% of the value borrowed through flash loans during only one six-month period. At the same time, use of flash loans continued to grow.
Security challenges for DeFi platforms
The researchers included an interview with an unnamed platform that had suffered a major flash loan attack. A representative said the exploited bug had passed internal checks and several audits, and had remained undetected on-chain for more than a year.
The incident also illustrated the human consequences of an attack. Hall said the attacker taunted the platform on social media afterward, prompting some victims to describe the financial damage and personal effects of the loss. The platform representative said attacks can fracture and ultimately destroy affected teams even when stolen funds are recovered.
The representative divided attackers into individual researchers and professional state-level or organized crime groups, citing North Korea. From a blockchain-security perspective, the representative said the professional attacks were not necessarily advanced, despite the scale of the damage they could cause.
The study period ended in July 2024, but flash-loan-related incidents have continued to affect DeFi. Decentralized exchange Bunni shut down in October 2025 after an $8.4 million exploit involving flash loans, saying it could not afford the cost of a secure relaunch.
Hall said the findings were intended to have practical relevance beyond academia, including for cryptocurrency companies, regulators, legal professionals and law-enforcement agencies.
Moneyiar market picture
Moneyiar data at 10:29 a.m. on October 7, 2026, showed mixed performance among the listed digital assets:
- ORDI: $4.2672653468, down 6.93% over 24 hours and 8.42% over seven days.
- Rain: $0.0111117054, down 2.57% over 24 hours and 10.44% over seven days.
- AI Rig Complex: $0.0697309296, down 2.43% over 24 hours and 2.49% over seven days.
Billions Network was listed in Moneyiar data at $0.0139971939, down 0.59% over 24 hours but up 10.04% over seven days. Its quoted data was timestamped at 1:39 a.m. on September 21, 2026.
