Flash Loan Attacks Drained $1.2B From DeFi Between 2020 and 2024: Study

Flash mortgage assaults drained $1.211 billion from decentralized finance platforms between February 2020 and July 2024, in keeping with newly published research within the Journal of Monetary Crime.

The examine, by Professor Tim Corridor of the College of Winchester and Remo Stieger, a former companion at Swiss danger intelligence agency SyntiFi, recognized 72 flash mortgage assaults amongst 254 profitable assaults on DeFi over the interval. These 254 assaults triggered $6.568 billion in losses, 18.44% of which got here from flash mortgage assaults.

Corridor said in a press release that “we now are seeing crimes that we’ve by no means seen earlier than,” some “able to stealing mind-boggling sums of cash, typically within the tens of tens of millions of {dollars}.”

Flash loans let customers borrow belongings from a liquidity pool with out collateral, supplied the mortgage is repaid throughout the identical blockchain transaction. Attackers use them to entry the big sums wanted to execute an exploit.

Greater than 80% of flash mortgage assault losses occurred on Ethereum, the examine discovered. Particular person assaults ranged from $80,000 to $197 million, and those who stole $10 million or extra accounted for over 88% of losses.

The researchers recognized 14 kinds of flash mortgage assault, falling into two broad teams: those who manipulate value feeds, and those who exploit flaws in a protocol’s underlying logic. Logic exploits had been much less frequent however triggered larger common losses.

Logic exploits accounted for 28% of flash mortgage assault losses between February 2020 and January 2022, and 55% from February 2022 to July 2024, in keeping with the paper.

4 assault varieties accounted for greater than 81% of losses: value oracle assaults, donate perform logic exploits, reentrancy assaults and a single governance assault, which price $181 million.

Flash mortgage attackers

Assault exercise moved via phases of progress and consolidation, which the authors write suggests platforms improved their safety after assaults whereas attackers discovered new vulnerabilities.

The examine drew on an interview with one platform that suffered a significant flash mortgage assault, granted anonymity at its request. The bug exploited had handed “ourselves and several other of the auditors,” the platform’s consultant mentioned, and went unnoticed on-chain for greater than a yr.

The attacker started “taunting” the platform on social media afterward, Corridor mentioned, which “led to some victims partaking with the attacker and outlining the devastating impacts that the lack of this cash had on them.”

The consultant divided attackers into “hobbyist particular person researchers” {and professional} state-level or organized crime teams, citing North Korea. From a blockchain safety perspective, the professionals’ assaults “are by no means superior,” the consultant mentioned.

The consultant additionally described the toll on groups that endure assaults, saying that “most frequently it finally ends up fracturing them and destroying them,” even when funds are recovered.

Losses exceeded 0.5% of the worth borrowed via flash loans in just one six-month interval, and flash mortgage use saved rising, the paper discovered.

The authors characterize the assaults as important, more and more subtle and unpredictable “however not existential” threats to DeFi.

For the reason that examine interval ended, decentralized trade Bunni shut down in October 2025 after an $8.4 million exploit that used flash loans, saying it couldn’t afford the price of a safe relaunch.

“We’re eager that this is not seen simply as a chunk of educational analysis,” Corridor mentioned. “The evaluation we did has a number of functions for the cryptocurrency trade, for regulators and for authorized and legislation enforcement companies.