A newly published study in the Journal of Financial Crime has quantified the damage from flash loan exploits in decentralized finance, finding that attackers stole $1.211 billion across 72 incidents between February 2020 and July 2024.
The research, led by Professor Tim Hall of the University of Winchester and Remo Stieger, a former partner at Swiss risk intelligence firm SyntiFi, examined 254 successful DeFi attacks that caused total losses of $6.568 billion. Flash loan attacks accounted for 18.44% of that total. More than 80% of flash loan losses occurred on Ethereum, and individual attacks ranged from $80,000 to $197 million. Attacks that stole at least $10 million represented over 88% of the combined losses.
The authors identified 14 types of flash loan attacks, split between those manipulating price feeds and those exploiting flaws in protocol logic. Logic exploits were less frequent but more damaging on average, rising from 28% of flash loan losses in the first period to 55% between February 2022 and July 2024. Four categories—price oracle attacks, donate function logic exploits, reentrancy attacks, and a single governance attack worth $181 million—accounted for more than 81% of losses.
The study describes phases of growth and consolidation, suggesting platforms patched vulnerabilities while attackers moved to new weaknesses. One interviewed platform, which remained anonymous, said a bug had passed both internal review and several auditors and remained unnoticed on-chain for more than a year. The representative divided attackers into hobbyist researchers and professional state-level or organized crime groups, including North Korea, adding that even professional attacks were “not at all advanced” from a blockchain security perspective.
Flash loan use continued to grow despite the attacks, and losses exceeded 0.5% of borrowed value in only one six-month period. The researchers called the threat significant, increasingly sophisticated, and unpredictable but “not existential” for DeFi. Since the study period, decentralized exchange Bunni shut down in October 2025 after an $8.4 million flash loan exploit. Hall said the analysis has applications for the crypto industry, regulators, and law enforcement.
