Flash Loan Attacks Cost DeFi Over $1.2 Billion in Four Years
A new study published in the Journal of Financial Crime reveals that flash loan attacks have siphoned $1.211 billion from decentralized finance (DeFi) platforms between February 2020 and July 2024. The research, conducted by Professor Tim Hall of the University of Winchester and Remo Stieger, a former partner at SyntiFi, identified 72 flash loan attacks among 254 successful DeFi exploits during this period. These attacks accounted for 18.44% of the total $6.568 billion lost to DeFi breaches.
Flash loans, which allow users to borrow assets without collateral as long as the loan is repaid within the same transaction, have become a favored tool for attackers. Over 80% of the losses from these attacks occurred on the Ethereum blockchain. The study highlighted that individual attacks ranged from $80,000 to $197 million, with attacks stealing $10 million or more contributing to over 88% of the total losses.
The researchers categorized flash loan attacks into 14 types, primarily dividing them into those that manipulate price feeds and those that exploit protocol logic flaws. Logic exploits, though less frequent, were more costly, accounting for 28% of flash loan attack losses between February 2020 and January 2022, and 55% from February 2022 to July 2024. Four attack types, price oracle attacks, donate function logic exploits, reentrancy attacks, and a single governance attack, were responsible for over 81% of the losses.
The study also noted that flash loan attacks have evolved through phases of growth and consolidation, suggesting that platforms are improving their security measures while attackers continuously seek new vulnerabilities. One platform representative anonymously shared that the exploited bug had evaded both internal reviews and multiple audits, remaining undetected on-chain for over a year. The representative also described the emotional toll on affected teams, often leading to their fragmentation and destruction, even when funds are recovered.