Flash loan attacks siphon over $1.2 billion from DeFi in four years

Researchers from the University of Winchester and a blockchain risk analyst have quantified the financial toll of flash loan attacks on decentralized finance (DeFi). Their study revealed that these attacks drained $1.211 billion from DeFi users between February 2020 and July 2024. The findings highlight a growing security challenge in the DeFi space, as these attacks became increasingly sophisticated over time.

The study, co-authored by Professor Tim Hall and Remo Stieger, analyzed 20.63 billion transactions across seven blockchains, including Ethereum and BNB Chain. They identified 254 successful DeFi attacks, with combined losses reaching $6.568 billion. Flash loan attacks accounted for 72 of these incidents, totaling $1.211 billion in damages.

Flash loans, a legitimate DeFi tool, allow users to borrow funds without collateral, provided the loan is repaid within the same transaction. Attackers exploit vulnerabilities in decentralized protocols using this mechanism. Professor Hall emphasized that these incidents are not victimless crimes and stressed the importance of the research for industry participants, regulators, and law enforcement.

The study also underscored the increasing sophistication of flash loan attacks, making them harder to predict. For DeFi users and protocols, the research serves as a stark reminder of the real-world costs of smart contract vulnerabilities. It also suggests that stopping these attacks may require more than just better code, pointing toward a more collaborative defense model.