Flash Loan Attacks Siphoned Over $1.2 Billion From DeFi Platforms
A new study published in the Journal of Financial Crime reveals that flash loan attacks have drained $1.211 billion from decentralized finance (DeFi) platforms between February 2020 and July 2024. The research, conducted by Professor Tim Hall of the University of Winchester and Remo Stieger, identified 72 flash loan attacks out of 254 successful DeFi exploits, accounting for 18.44% of the total $6.568 billion in losses during this period.
The study analyzed seven blockchains where flash loans are available: Ethereum, Base, Optimism, Arbitrum, BNB Chain, Avalanche, and Polygon. Over 80% of the flash loan losses occurred on Ethereum. Flash loans, which are uncollateralized and repaid within the same transaction, were exploited by attackers to borrow large sums at near-zero cost, often leading to significant financial damage.
The researchers categorized the attacks into 14 types, with four types responsible for over 81% of the losses. These included price oracle attacks, donate function logic exploits, reentrancy attacks, and a single governance attack that cost $181 million. The study also found that logic exploits, which accounted for 28% of flash loan losses between 2020 and 2022, increased to 55% between 2022 and 2024, indicating a shift in attack strategies.
The study highlights that individual attacks ranged from $80,000 to $197 million, with attacks exceeding $10 million accounting for over 88% of all losses. Despite the significant damage, the researchers noted that losses exceeded 0.5% of the value borrowed through flash loans in only one six-month period, suggesting that the overall impact remains relatively small compared to the volume of flash loan activity.
The authors concluded that while flash loan attacks are significant and increasingly sophisticated, they are not an existential threat to DeFi. The study includes recommendations on collateral and oracle design, though these could not be verified from the available material. The research aims to provide practical insights for the cryptocurrency industry, regulators, and law enforcement agencies.