Flash Loan Attacks Drained $1.2B From DeFi Between 2020 and 2024: Study

In brief

• Flash loan attacks caused $1.211 billion in losses across 72 incidents between February 2020 and July 2024, according to a study in the Journal of Financial Crime.
• That was 18.44% of the $6.568 billion lost to all DeFi attacks in the period, with more than 80% of flash loan losses on Ethereum.
• Attacks exploiting flaws in protocol logic were rarer but costlier, and grew in significance as platforms patched exploited weaknesses and attackers moved on.

Flash loan attacks drained $1.211 billion from decentralized finance platforms between February 2020 and July 2024, according to newly published research in the Journal of Financial Crime.

The study, by Professor Tim Hall of the University of Winchester and Remo Stieger, a former partner at Swiss risk intelligence firm SyntiFi, identified 72 flash loan attacks among 254 successful attacks on DeFi over the period. Those 254 attacks caused $6.568 billion in losses, 18.44% of which came from flash loan attacks.

Hall said in a statement that "we now are seeing crimes that we have never seen before," some "capable of stealing mind-boggling sums of money, often in the tens of millions of dollars."

Flash loans let users borrow assets from a liquidity pool without collateral, provided the loan is repaid within the same blockchain transaction. Attackers use them to access the large sums needed to execute an exploit.