Summary
- Flash loan attacks resulted in $1.211 billion in losses across 72 incidents from February 2020 to July 2024, as reported by a study in the Journal of Financial Crime.
- This figure represents 18.44% of the total $6.568 billion lost to all DeFi-related attacks during that time, with over 80% of the losses occurring on Ethereum.
- While protocol logic flaws were less common, they were more damaging, gaining prominence as platforms addressed previously exploited vulnerabilities.
According to a recent study published in the Journal of Financial Crime, flash loan attacks siphoned off $1.211 billion from decentralized finance (DeFi) platforms between February 2020 and July 2024. The research, conducted by Professor Tim Hall from the University of Winchester and Remo Stieger, a former partner at Swiss risk intelligence firm SyntiFi, documented 72 flash loan attacks among 254 successful DeFi attacks during this period. Altogether, these incidents resulted in losses totaling $6.568 billion, with flash loans accounting for 18.44% of that amount.
Groundbreaking research highlights a new wave of cybercrime leading to astonishing thefts in the digital finance and cryptocurrency sectors, according to Professor Tim Hall, as shared by the University of Winchester. More on flash loan attacks can be found here.
— University of Winchester (@_UoW) October 5, 2026
Hall noted that "we now are seeing crimes that we have never seen before," with some capable of stealing incredible amounts, often reaching into the tens of millions of dollars.
Flash loans allow users to borrow assets from a liquidity pool without collateral, provided the loan is repaid within the same transaction on the blockchain. Attackers utilize these loans to obtain the substantial sums necessary for executing exploits.
The study revealed that over 80% of the losses from flash loan attacks occurred on Ethereum. Individual attacks varied in scale, ranging from $80,000 to $197 million, with those stealing $10 million or more representing over 88% of total losses.
Researchers identified 14 distinct types of flash loan attacks, which can be categorized into two main groups: those that manipulate price feeds and those that exploit flaws in the underlying logic of protocols. Although logic exploits were less frequent, they resulted in higher average losses.
Logic exploits accounted for 28% of flash loan attack losses from February 2020 to January 2022, increasing to 55% from February 2022 to July 2024, according to the findings.
The four primary attack types made up over 81% of the losses: price oracle attacks, logic exploits related to donation functions, reentrancy attacks, and a single governance attack that resulted in a loss of $181 million.
Profile of Flash Loan Attackers
Attack activity exhibited patterns of growth and consolidation, suggesting that platforms enhanced their security in response to attacks while attackers identified new vulnerabilities.
The study incorporated insights from an anonymous interview with a platform that experienced a significant flash loan attack. The platform's representative noted that the exploited bug had evaded detection by both their team and several auditors for over a year.
Myriad: Where does Ethereum go next? Click to make your prediction.After the incident, the attacker began "taunting" the platform on social media, which led some victims to engage with the attacker and express the significant impact of the financial loss on their operations, Hall reported.
The representative classified attackers into two categories: "hobbyist individual researchers" and organized crime groups, including those with state backing like North Korea. From a blockchain security standpoint, the representative described the professionals' attacks as relatively unsophisticated.
Furthermore, the representative shared that the aftermath of these attacks often fractures and devastates the teams involved, even when funds are eventually recovered.
Notably, losses exceeded 0.5% of the total value borrowed via flash loans during only one six-month period, and the use of flash loans continued to rise, according to the study's findings.
The authors characterized these attacks as significant threats to DeFi, increasingly sophisticated and unpredictable, but not existential in nature. Following the conclusion of the study period, the decentralized exchange Bunni shut down in October 2025 after an $8.4 million exploit that involved flash loans, citing an inability to finance a secure relaunch.
Hall emphasized the importance of this research, stating, "We are keen that this isn't seen just as a piece of academic research. The analysis we did has a host of applications for the cryptocurrency industry, for regulators and for legal and law enforcement agencies."