Flash Loan Attacks Drained $1.2B From DeFi Between 2020 and 2024: Study

What it is

Research from Prof. Tim Hall (University of Winchester) and Remo Stieger (formerly of Swiss risk intelligence firm SyntiFi), published in the Journal of Financial Crime, analyzing 72 flash loan attacks drawn from 254 total DeFi attacks between February 2020 and July 2024.

How it works

The paper taxonomizes flash loan attacks into 14 types across two groups: price-feed manipulation and protocol-logic exploits. Four attack types — price oracle attacks, donate-function logic exploits, reentrancy, and a single $181M governance exploit — together accounted for over 81% of losses. Individual attacks ranged from $80,000 to $197 million, and attacks stealing $10M+ accounted for over 88% of total losses. The authors note a phase shift: logic exploits (rarer but costlier) grew from 28% of losses (Feb 2020–Jan 2022) to 55% (Feb 2022–Jul 2024), which they interpret as platforms patching known price-feed weaknesses while attackers pivoted to logic flaws.

Preconditions / Affected

Over 80% of flash loan attack losses occurred on Ethereum. Losses exceeded 0.5% of total value borrowed via flash loans in only one six-month period despite continued growth in flash loan usage — meaning the attack surface scales with adoption but realized loss rate has stayed comparatively low.

What to do

The paper has no technical mitigation steps, but offers two actionable intelligence points for security/incident teams:

• The interviewed victim platform reported its exploited bug passed both internal review and "several" external auditors, remaining undetected on-chain for over a year — a reminder that audit sign-off is not a reliability guarantee for flash-loan-class logic bugs specifically.
• The same platform's representative distinguishes "hobbyist individual researchers" from state-level/organized groups (citing North Korea), noting that from a blockchain security perspective the professional groups' attacks "are not at all advanced" — attribution by technical sophistication alone is unreliable.

Caveats

The $181M governance exploit is reported as a single outlier within the four dominant categories, not a representative average. The study characterizes flash loan attacks overall as "significant, increasingly sophisticated and unpredictable but not existential" to DeFi — the authors' own framing, not an independent risk rating. No specific protocol, CVE, or patch is named; the Bunni DEX shutdown (Oct 2025, $8.4M flash-loan exploit) is cited only as a post-study-period example, with no further detail on mechanism.