$1B Flash Loan Attack Exposes Hidden DeFi Money Laundering Risks

Blockaid has warned that flash loans exceeding $1 billion could expose financial institutions to money laundering and sanctions risks after an attacker used Aave lending markets to finance a September exploit that drained about $250,000 from Balancer V1.

In an October 22 post on X, the security firm said the incident exposed weaknesses in compliance systems that monitor account balances rather than track how funds move between wallets.

How the Balancer-Aave Attack Worked

On September 6, the attacker borrowed more than $1 billion through flash loans and used the funds as collateral across three Aave V3 markets. This enabled additional borrowing of $788 million before the attacker exploited Balancer V1 and repaid the loans within the same transactions.

Related: CoinDCX Denies New Security Breach After $16M USDT Transfer Alert

Because the funds were returned before the transactions ended, balance-based checks could miss the activity. Aave suffered no direct losses.

Blockaid Calls for Real-Time Monitoring

Blockaid said it flagged the attacker’s address hours before the exploit after tracing its funding to Tornado Cash, a crypto mixing service. Its monitoring system also alerted a customer when exposure to stolen funds crossed a preset threshold.

The firm said compliance teams need transaction histories, tools to identify entities behind transfers and continuous monitoring to detect suspicious activity. These measures can help institutions investigate potential illicit flows and demonstrate compliance during regulatory reviews.

Related: UAE-Led Global Operation Flags $39B in Suspected Fraud-Linked Assets