Academic Study Finds Flash Loan Attacks Drained $1.21 Billion, Over 80% on Ethereum (ETH)

72 Attacks, Four Years of Losses

A newly published academic tally estimates that flash loan attacks stripped more than $1.21 billion from decentralized finance between February 2020 and July 2024, and it reports that over 80% of that damage landed on Ethereum (ETH). The study, released in the Journal of Financial Crime, was written by Tim Hall, a professor at the University of Winchester, and Remo Schütiger, previously a partner at Syntifi. The pair reviewed successful DeFi attacks across the period and logged 254 in total, of which 72 were executed with flash loans. Those 72 incidents produced an estimated $1.211 billion in losses, equal to 18.44% of the $6.568 billion that all successful attacks on DeFi platforms drained over the same window. To reconstruct that loss ledger, the researchers reported combing through more than 20 billion transactions, giving the count a base in observed on-chain records rather than incident reports alone.

A flash loan lets a borrower pull assets from a liquidity pool without posting collateral, on the condition that the borrowed funds are repaid inside the same blockchain transaction. Attackers turn the design into a weapon, renting the large capital a vulnerability strike requires for the span of a single block and paying only gas fees to move it; a failed attempt simply reverts, leaving nothing behind but the bill. Hall said in the study that “crimes never seen before” are now appearing in the sector, and that some individual attacks capture tens of millions of dollars in one operation. The per-attack totals varied widely, from roughly $80,000 at the low end to as much as $197 million at the top. The distribution is heavily top-heavy: incidents that captured $10 million or more accounted for an estimated 88% or more of all flash loan losses recorded. The figures track funds taken from protocols, not the Ethereum price, which the study does not examine.

The researchers sorted the 72 incidents into 14 subtypes under two broad families: price-data manipulation, where attackers distort the information a protocol uses to price assets, and logic vulnerability attacks, which abuse flaws in a protocol’s own smart contract design or functionality. Logic flaws struck less often but cost more per incident. Their share of total flash loan losses climbed from 28% in the period running from February 2020 to January 2022 to 55% between February 2022 and July 2024. The study’s reading is that as platforms patched the weaknesses exploited in earlier waves, attackers shifted toward fresh ones. Concentration is stark. Four attack types, price oracle manipulation, donation-function logic flaws, reentrancy, and governance attacks, account for an estimated 81% or more of all flash loan losses. The governance category covers a single incident, and it alone cost roughly $181 million, mounted against a protocol’s DAO. The study also records testimony from an anonymous operator whose platform absorbed a large flash loan attack: the exploited bug passed both internal review and checks by multiple external audit firms, then sat on-chain undetected for more than a year. After the theft, the perpetrators taunted the platform across social media, turning the aftermath into public FUD, and some victims described their losses directly to the attackers. The operator divided attackers into hobbyist individual researchers and professional criminal organizations, citing North Korea as an example of the latter, while noting the techniques themselves are not necessarily sophisticated. Even where stolen funds came back, teams often split or effectively collapsed afterward. The count stays provisional: losses exceeded 0.5% of total borrowed flash loan value in only one six-month stretch, and usage has kept climbing since the window closed. Bunni, a decentralized exchange, shut down after an $8.4 million flash loan attack in October 2025, saying it could not fund a secure relaunch.

A Floor, Not a Final Count

COINOTAG’s reading: the $1.211 billion figure is a single, settled count, and it rests on observed on-chain activity across billions of transactions rather than self-reported breaches. What the tally does not cover is everything after July 2024, Bunni’s $8.4 million shutdown included, so the cumulative cost is best treated as a floor. The 80% concentration across the Ethereum (ETH) ecosystem says more about where DeFi liquidity and attack surface lived than about any flaw in the chain itself. The researchers’ own verdict stays measured: flash loan attacks are costly and increasingly intricate, but not, in their assessment, a threat to DeFi’s survival.