Flash Loan Attacks Drained $1.2B From DeFi Between 2020 and 2024: Study

Flash loan attacks drained $1.211 billion from decentralized finance platforms between February 2020 and July 2024, according to newly published research in the Journal of Financial Crime.

The study, by Professor Tim Hall of the University of Winchester and Remo Stieger, a former partner at Swiss risk intelligence firm SyntiFi, identified 72 flash loan attacks among 254 successful attacks on DeFi over the period. Those 254 attacks caused $6.568 billion in losses, 18.44% of which came from flash loan attacks.

Hall said in a statement that "we now are seeing crimes that we have never seen before," some "capable of stealing mind-boggling sums of money, often in the tens of millions of dollars."

Flash loans let users borrow assets from a liquidity pool without collateral, provided the loan is repaid within the same blockchain transaction. Attackers use them to access the large sums needed to execute an exploit.

More than 80% of flash loan attack losses occurred on Ethereum, the study found. Individual attacks ranged from $80,000 to $197 million, and those that stole $10 million or more accounted for over 88% of losses.

The researchers identified 14 types of flash loan attack, falling into two broad groups: those that manipulate price feeds, and those that exploit flaws in a protocol's underlying logic. Logic exploits were less frequent but caused higher average losses.

Logic exploits accounted for 28% of flash loan attack losses between February 2020 and January 2022, and 55% from February 2022 to July 2024, according to the paper.

Four attack types accounted for more than 81% of losses: price oracle attacks, donate function logic exploits, reentrancy attacks and a single governance attack, which cost $181 million.

Flash loan attackers

Attack activity moved through phases of growth and consolidation, which the authors write suggests platforms improved their security after attacks while attackers found new vulnerabilities.

The study drew on an interview with one platform that suffered a major flash loan attack, granted anonymity at its request. The bug exploited had passed "ourselves and several of the auditors," the platform's representative said, and went unnoticed on-chain for more than a year.

The attacker began “taunting” the platform on social media afterward, Hall said, which "led to some victims engaging with the attacker and outlining the devastating impacts that the loss of this money had on them."

The representative divided attackers into "hobbyist individual researchers" and professional state-level or organized crime groups, citing North Korea. From a blockchain security perspective, the professionals' attacks "are not at all advanced," the representative said.

The representative also described the toll on teams that suffer attacks, saying that "most often it ends up fracturing them and destroying them," even when funds are recovered.

Losses exceeded 0.5% of the value borrowed through flash loans in only one six-month period, and flash loan use kept growing, the paper found.

The authors characterize the attacks as significant, increasingly sophisticated and unpredictable "but not existential" threats to DeFi.

Since the study period ended, decentralized exchange Bunni shut down in October 2025 after an $8.4 million exploit that used flash loans, saying it could not afford the cost of a secure relaunch.

"We are keen that this isn't seen just as a piece of academic research," Hall said. "The analysis we did has a host of applications for the cryptocurrency industry, for regulators and for legal and law enforcement agencies.