A study by Professor Tim Hall and Remo Stieger in the Journal of Financial Crime reveals that flash loan attacks drained $1.211 billion from DeFi platforms between February 2020 and July 2024, representing 18.44% of all DeFi exploit losses. The research highlights a tactical shift, with protocol logic exploits rising from 28% to 55% of losses. While Ethereum absorbed over 80% of the damage, researchers characterize these growing threats as highly sophisticated but not existential to the DeFi ecosystem.
Scale of flash loan losses
- ▪Flash loan borrowing volume continuously increased between February 2020 and July 2024, but losses exceeded 0.5% of the total borrowed in only one six-month stretch.
- ▪Individual flash loan exploits ranged from $80,000 to $197 million, with attacks stealing $10 million or more accounting for over 88% of the total losses.
- ▪A Journal of Financial Crime study found flash loan attacks drained $1.211 billion from decentralized finance platforms across 72 incidents between February 2020 and July 2024, representing 18.44% of $6.568 billion lost across 254 exploits.
Common flash loan exploit types
- ▪Four specific flash loan exploit types—price oracle attacks, donate-function logic exploits, reentrancy attacks, and a single $181 million governance attack—accounted for over 81% of all flash loan losses.
- ▪Protocol logic exploits accounted for 28% of flash loan losses between February 2020 and January 2022, but rose to 55% of losses between February 2022 and July 2024 as attackers shifted away from price feed manipulation.
Statements from exploited platform representatives
- ▪An anonymous representative of an exploited platform stated that suffering a flash loan attack often fractures and destroys the affected development teams, even if the stolen funds are eventually recovered.
- ▪An anonymous representative of an exploited platform stated that professional state-level or organized crime groups, including North Korea, execute attacks that are technically not advanced from a blockchain security perspective.
Research methodology of the study
- ▪Researchers analyzed 20.63 billion transactions across seven blockchain networks, including Ethereum, Base, Optimism, Arbitrum, BNB Chain, Avalanche, and Polygon.
- ▪The study by Professor Tim Hall and Remo Stieger is the first to combine traditional criminology research methods with on-chain data analysis.
Debatable claims
- ▪Flash loan attacks pose an existential threat to decentralized finance
- ▪Most flash loan exploits are highly sophisticated cyberattacks
- ▪DeFi protocol developers bear the primary responsibility for flash loan exploits
- ▪DeFi platforms should ban flash loans
Story comments
Loading comments…