Flash Loan Attacks Drained $1.21B From DeFi Between 2020 and 2024, Study Finds

Flash loan attacks drained $1.211 billion from decentralized finance platforms between February 2020 and July 2024, according to research published in the Journal of Financial Crime. The study, by University of Winchester professor Tim Hall and Remo Stieger, a former partner at Swiss risk intelligence firm SyntiFi, identified 72 flash loan attacks among 254 successful DeFi exploits over the period. Those 254 attacks caused $6.568 billion in losses, 18.44% of which came from flash loan attacks. More than 80% of flash loan attack losses occurred on Ethereum, with individual attacks ranging from $80,000 to $197 million. Attacks stealing $10 million or more accounted for over 88% of losses. Four attack types — price oracle attacks, donate function logic exploits, reentrancy attacks and a single governance attack costing $181 million — drove more than 81% of losses. Logic exploits rose to 55% of flash loan attack losses between February 2022 and July 2024, up from 28% in the prior period. Since the study period ended, decentralized exchange Bunni shut down in October 2025 after an $8.4 million flash loan exploit, saying it could not afford a secure relaunch.