Flash Loan Attacks Drained $1.2B From DeFi Between 2020 and 2024: Study

Researchers Tim Hall (University of Winchester) and Remo Stieger (former SyntiFi partner) report that flash loan attacks caused $1.211 billion in losses across 72 incidents from February 2020 through July 2024. The study, published in the Journal of Financial Crime, counted 254 successful DeFi attacks in the period that together produced $6.568 billion in losses, with flash loan exploits representing about 18.44% of that total.

More than 80% of the losses from flash loan attacks occurred on Ethereum. Individual exploit proceeds ranged from roughly $80,000 up to $197 million, and attacks that netted $10 million or more made up over 88% of total flash loan losses. The authors identified 14 flash loan attack types, which they grouped into two broad classes: manipulations of price feeds (oracle attacks) and exploits of protocol logic. While logic-based exploits were less common, they caused larger average losses and became a larger share of flash loan losses over time.

According to the paper, logic exploits represented 28% of flash-loan-related losses between February 2020 and January 2022, rising to 55% from February 2022 through July 2024. Four attack mechanisms — price oracle manipulation, donate-function logic exploits, reentrancy attacks, and a single governance attack that cost $181 million — accounted for more than 81% of flash loan losses. The authors describe attack activity moving through phases of expansion and consolidation, which they interpret as evidence that platforms improved defences while attackers found new weaknesses.

The study also incorporated an anonymous interview with a platform that suffered a major flash loan exploit; its representative said the bug had passed internal and external audits and remained undetected on-chain for over a year, and described severe operational and human impacts following the attack. The authors conclude that flash loan attacks are significant, increasingly sophisticated and unpredictable threats to DeFi, though they characterise them as "not existential." The paper notes flash loan usage kept growing and that losses exceeded 0.5% of value borrowed through flash loans in only one six-month period. Hall said the analysis has practical applications for industry participants, regulators and law enforcement.