Flash loan attacks drained $1.211 billion from decentralized finance platforms across 72 documented incidents between February 2020 and July 2024, according to research published in the Journal of Financial Crime by Professor Tim Hall of the University of Winchester and Remo Stieger, a former partner at Swiss risk intelligence firm SyntiFi.

The figure represents 18.44% of the $6.568 billion lost across all 254 successful DeFi attacks catalogued in the study, placing flash loan exploits among the most consequential threat categories in the sector over the 4.5-year window.

"We now are seeing crimes that we have never seen before," Hall said in a statement accompanying the paper. Some of these attacks, he added, are "capable of stealing mind-boggling sums of money, often in the tens of millions of dollars."

More than 80% of flash loan attack losses occurred on Ethereum, the study found. Individual incidents ranged from $80,000 to $197 million, and those that siphoned $10 million or more accounted for over 88% of total losses.

How do flash loan attacks work?

Flash loans let borrowers draw on pooled liquidity without posting collateral, provided the principal and fee are repaid within the same blockchain transaction. Attackers use them to acquire the capital required to manipulate price oracles, trigger reentrancy bugs or squeeze thinly traded pools, extracting profit in the same atomic transaction that returns the borrowed funds.

The researchers identified 14 distinct flash loan attack types, grouped into two categories:

• Attacks that manipulate price feeds
• Attacks that exploit flaws in a protocol's core logic

Logic exploits proved rarer but more damaging on average. They accounted for 28% of flash loan losses between February 2020 and January 2022, and 55% from February 2022 to July 2024, as platforms patched price-manipulation vectors and attackers shifted toward code-level vulnerabilities.

Four attack types drove more than 81% of losses:

• Price oracle attacks
• Donate function logic exploits
• Reentrancy attacks
• A single governance attack that cost $181 million

How have attackers evolved?

Attack activity moved through "phases of growth and consolidation," the authors wrote, a pattern consistent with protocols hardening exploited weaknesses while adversaries migrated to new code paths. One victim platform, granted anonymity in the study, told researchers the vulnerability had "passed ourselves and several of the auditors" and went unnoticed on-chain for more than a year.

After the exploit, Hall said, the attacker began "taunting" the platform on social media, "which led to some victims engaging with the attacker and outlining the devastating impacts that the loss of this money had on them."

The same platform representative drew a sharp line between attacker categories. They labeled them "hobbyist individual researchers" and professional state-level or organized crime groups, pointing specifically to North Korea. The professionals' attacks, the representative said, "are not at all advanced" from a blockchain security perspective.

The human cost on defending teams is severe. Most often an attack "ends up fracturing them and destroying them," the representative said, "even when funds are recovered."

Are flash loan attacks growing or shrinking?

Losses exceeded 0.5% of the value borrowed through flash loans in only one six-month period within the study window. Flash loan use kept expanding across the same period, and the authors characterize the threat as significant, increasingly sophisticated and unpredictable, but "not existential" to DeFi as a whole.

The dataset's relevance has continued to extend past its July 2024 cutoff. In October 2025, decentralized exchange Bunni shut down after an $8.4 million exploit that used flash loans, with the team stating it could not afford the cost of a secure relaunch.

Hall framed the research as an operational tool rather than an academic artifact. "We are keen that this isn't seen just as a piece of academic research," he said. "The analysis we did has a host of applications for the cryptocurrency industry, for regulators and for legal and law enforcement agencies."

The paper, released in October 2026, gives DeFi protocols, auditors and regulators a shared empirical baseline to track losses against as new flash-loan-enabled exploits continue to force platform closures.