A peer-reviewed study in the Journal of Financial Crime found flash loan attacks drained $1.211 billion from decentralized finance platforms between February 2020 and July 2024, across 72 separate incidents. More than 80% of those losses hit Ethereum, and the attacks grew more sophisticated as the study period went on.
Flash loan attacks drained $1.211 billion from DeFi platforms between February 2020 and July 2024, according to a study by Professor Tim Hall of the University of Winchester and Remo Stieger, a former partner at Swiss risk intelligence firm SyntiFi. The research appears in the Journal of Financial Crime.
72 incidents, outsized damage
The 72 flash loan attacks sat among 254 successful attacks on DeFi over the period, which together caused $6.568 billion in losses — flash loans accounted for 18.44% of that total. More than 80% of flash loan losses occurred on Ethereum, and individual attacks ranged from $80,000 to $197 million. Attacks that stole $10 million or more made up over 88% of total losses.
Researchers scanned 20.63 billion transactions across seven blockchains, including Ethereum and BNB Chain, to compile the dataset. A flash loan lets a user borrow assets from a liquidity pool without collateral, provided the loan is repaid within the same transaction — attackers use that temporary firepower to execute an exploit in a single move.
Logic exploits grew costlier over time
The study identified 14 types of flash loan attack, split into two groups: those that manipulate price feeds, and those that exploit flaws in a protocol's own logic. Logic exploits were rarer but caused higher average losses, and their share of flash loan losses rose from 28% in the first phase of the study to 55% in the second.
Four attack types — price oracle attacks, donate function logic exploits, reentrancy attacks, and a single governance attack that cost $181 million — accounted for more than 81% of losses. According to Hall, "we now are seeing crimes that we have never seen before".
Not existential, but still growing
Losses exceeded 0.5% of the value borrowed through flash loans in only one six-month period, and flash loan use kept growing throughout the study window. The authors describe the attacks as significant, increasingly sophisticated and unpredictable — but not existential threats to decentralized finance.
Sources: Decrypt, Crypto Briefing
Trading involves risk.
Risk Disclaimer
