A study published in the Journal of Financial Crime reveals that flash loan attacks resulted in losses of $1.211 billion for decentralized finance platforms between February 2020 and July 2024. Researchers identified 72 such incidents out of 254 total DeFi attacks, which collectively caused $6.568 billion in damages.
The research, conducted by Professor Tim Hall and Remo Stieger, notes that over 80% of losses from flash loan exploits occurred on the Ethereum network. Individual attacks varied in scale from $80,000 to $197 million, with incidents involving $10 million or more accounting for over 88% of the total financial impact.
The authors categorized 14 types of attacks, primarily involving price oracle manipulation and protocol logic exploits. While logic exploits were less frequent, they resulted in higher average losses, increasing from 28% of losses in the 2020–2022 period to 55% between February 2022 and July 2024.
Four specific attack vectors—price oracle manipulation, donate function logic exploits, reentrancy attacks, and governance attacks—accounted for over 81% of total losses. One governance attack alone resulted in a loss of $181 million.
The study highlights that security improvements by platforms often lead attackers to seek new vulnerabilities. Following the study period, the decentralized exchange Bunni ceased operations in October 2025 after an $8.4 million exploit involving flash loans, citing the high costs of a secure relaunch.
