From Decrypt · By Decrypt Agent
In brief
Flash loan attacks caused $1.211 billion in losses across 72 incidents between February 2020 and July 2024, according to a study in the Journal of Financial Crime.
That was 18.44% of the $6.568 billion lost to all DeFi attacks in the period, with more than 80% of flash loan losses on Ethereum.
Attacks exploiting flaws in protocol logic were rarer but costlier, and grew in significance as platforms patched exploited weaknesses and attackers moved on.
Flash loan attacks drained $1.211 billion from decentralized finance platforms between February 2020 and July 2024, according to newly published research in the Journal of Financial Crime.
The study, by Professor Tim Hall of the University of Winchester and Remo Stieger, a former partner at Swiss risk intelligence firm SyntiFi, identified 72 flash loan attacks among 254 successful attacks on DeFi over the period. Those 254 attacks caused $6.568 billion in losses, 18.44% of which came from flash loan attacks.
A new type of cybercrime is seeing mind-boggling sums stolen in the world of digital finance and crypto currencies, according to ground-breaking research involving Prof Tim Hall, an academic @_UoW. Read about flash loan attacks here https://t.co/STrwz5huPO pic.twitter.com/JkGAqsJJED
— University of Winchester (@_UoW) October 5, 2026
Hall said in a statement that "we now are seeing crimes that we have never seen before," some "capable of stealing mind-boggling sums of money, often in the tens of millions of dollars."
Flash loans let users borrow assets from a liquidity pool without collateral, provided the loan is repaid within the same blockchain transaction. Attackers use them to access the large sums needed to execute an exploit.
More than 80% of flash loan attack losses occurred on Ethereum, the study found. Individual attacks ranged from $80,000 to $197 million, and those that stole $10 million or more accounted for over 88% of losses.
The researchers identified 14 types of flash loan attack, falling into two broad groups: those that manipulate price feeds, and those that exploit flaws in a protocol's underlying logic. Logic exploits were less frequent but caused higher average losses.
Logic exploits accounted for 28% of flash loan attack losses between February 2020 and January 2022, and 55% from February 2022 to July 2024, according to the paper.
Four attack types accounted for more than 81% of losses: price oracle attacks, donate function logic exploits, reentrancy attacks and a single governance attack, which cost $181 million.
Flash loan attackers
Attack activity moved through phases of growth and consolidation, which the authors write suggests platforms improved their security after attacks while attackers found new vulnerabilities.