Flash loan attacks drained $1.211 billion from decentralized finance between February 2020 and July 2024, according to a peer-reviewed study published in the Journal of Financial Crime. That is 18.44% of the $6.568 billion the researchers counted in total losses from 254 successful DeFi attacks, from a scan of 20.63 billion transactions across seven blockchains, including Ethereum and BNB Chain.
The study was co-authored by Professor Tim Hall of the University of Winchester’s Department of Policing, Criminology and Forensics and Remo Stieger, formerly of SyntiFi Risk Intelligence. The researchers say it is the first to combine traditional criminology with on-chain intelligence analysis, and they concluded that flash loan attacks grew more sophisticated and harder to predict over the study period. Hall, in the university’s press release, said these incidents “are not victimless crimes”.
The picture is concentrated. More than 80% of flash loan losses landed on Ethereum, and individual attacks ranged from $80,000 to $197 million. Attacks that stole $10 million or more made up over 88% of the damage. The researchers identified 14 attack types in two groups, price feed manipulation and protocol logic exploits, and four types alone, including price oracle attacks and reentrancy attacks, drove more than 81% of losses, alongside a single governance attack worth $181 million.
The mix of attacks shifted over the window. Logic exploits accounted for 28% of flash loan losses before February 2022 but 55% after, as attackers moved away from manipulating price feeds toward abusing flaws in a protocol’s code.
The authors frame the threat as significant but “not existential”: losses exceeded 0.5% of the value borrowed through flash loans in only one six-month period, and flash loan use kept growing anyway. One platform representative the researchers interviewed, granted anonymity, said the bug that was exploited had passed “ourselves and several of the auditors” and sat unnoticed on-chain for more than a year.
After the study window closed, the decentralized exchange Bunni shut down in October 2025 after an $8.4 million flash loan exploit, saying it could not afford a secure relaunch.
