Flash loan attacks drain $1.2B from DeFi, most on Ethereum

4.1 Security

Oct 7, 2026

Flash loan attacks caused $1.2B in DeFi losses (2020–2024), 80% on Ethereum. Logic flaws drove 55% of recent attacks, which have grown more sophisticated and costly.

A series of academic studies published in the Journal of Financial Crime reveal that flash loan attacks led to $1.211 billion in losses across 72 incidents in decentralized finance (DeFi) from February 2020 to July 2024. These attacks accounted for 18.44% of the $6.568 billion lost to all DeFi exploits during this period, with over 80% of the losses occurring on the Ethereum blockchain. The research, led by Tim Hall and Remo Stieger, found that protocol logic flaws became the dominant cause of flash loan losses by 2024, rising from 28% to 55% of such incidents. Four main attack types—price oracle manipulation, donate-function logic exploits, reentrancy attacks, and a major governance exploit—were responsible for over 81% of the total damage. The studies highlight the increasing sophistication and unpredictability of flash loan exploits, as attackers adapt to improved platform defenses. Most incidents involved sums exceeding $10 million, with some reaching up to $197 million.