Flash Loan Attacks Drained $1.211B From DeFi, Study Finds

What happened

A study in the Journal of Financial Crime reports that flash loan attacks drained $1.211 billion from DeFi platforms between February 2020 and July 2024. Professor Tim Hall of the University of Winchester and Remo Stieger, a former partner at Swiss risk intelligence firm SyntiFi, wrote the research.

The researchers identified 72 flash loan attacks among 254 successful DeFi attacks. Those 254 attacks caused $6.568 billion in losses, and 18.44% of that came from flash loan attacks. More than 80% of flash loan attack losses occurred on Ethereum, and individual attacks ranged from $80,000 to $197 million.

The study identified 14 types of flash loan attack in two groups: price feed manipulation and protocol logic flaws. Four attack types caused more than 81% of losses: price oracle attacks, donate function logic exploits, reentrancy attacks and one governance attack that cost $181 million. Logic exploits made up 28% of losses from February 2020 to January 2022, then rose to 55% from February 2022 to July 2024.

Why it matters

The authors say the attacks are increasingly complex and harder to predict but not a threat to DeFi's survival. They stress that flash loans are legal tools, and the attacks exploit weaknesses in the platforms around them.

A platform that suffered an attack said its bug had passed internal checks and several outside auditors, then sat on-chain unnoticed for more than a year. The same representative said attacks often fracture and destroy teams, even when funds are recovered. Losses exceeded 0.5% of the value borrowed through flash loans in only one six-month period, and the study period ended in July 2024 with related damage continuing.

What the data shows

The team scanned 20.63 billion blockchain transactions across seven networks, including Ethereum, Base, Optimism, Arbitrum, BNB Chain, Avalanche and Polygon. Attacks that stole $10 million or more made up over 88% of losses.

Background

The University of Winchester says this is the first study to combine criminal research methods with on-chain data in this way. The full paper was behind a paywall, so some details come from the university's summary rather than the complete text.

What is still unclear

• The full paper was behind a paywall, so some details come from the university's summary rather than the complete text.
• The study drew on an interview with one platform that suffered a major flash loan attack, granted anonymity at its request.

Questions readers ask