DeFi flash loan attacks shifted to protocol logic flaws, which caused 55% of losses by 2024

Attacks exploiting errors in a DeFi protocol’s code caused 55% of flash loan losses from February 2022 to July 2024, according to a paper published in the Journal of Financial Crime. Their share was 28% over the prior two years, and the jump put them ahead of price feed manipulation attacks.

The study was written by Tim Hall, professor at the department of policing and criminology at the University of Winchester, and Remo Stieger, ex-partner at SyntiFi Risk Intelligence. Between February 2020 and July 2024, they recorded 72 flash loan attacks with a total loss of $1.211 billion.

Four attack types caused over 81% of the damage

A flash loan lets a borrower take uncollateralized crypto, provided it is paid back before the same blockchain transaction ends. There’s nothing illegal about that, but it gives the attacker the capital to run an exploit with no risk to themselves.

Out of the 14 attack types in the study, one family games the price data a protocol trusts and the other abuses bugs in its logic. The logic family hit fewer targets and cost more on average.

Price oracle attacks, donate-function logic exploits and reentrancy attacks, plus a single $181 million governance attack, together account for over 81% of losses.

The authors saw waves of attacks rising and then settling. They link the pattern to platforms hardening their defenses after each round and attackers finding new weak spots.

Ethereum absorbed more than 80% of the $1.211 billion

Attacks of $10 million or more, from a range of $80,000 to $197 million, made up more than 88% of losses, and Ethereum alone took more than 80%.

Flash loans accounted for 18.44% of the $6.568 billion taken in 254 successful DeFi attacks across the full period. SyntiFi’s on-chain engine went through 20.63 billion transactions on Ethereum, Base, Optimism, Arbitrum, BNB Chain, Avalanche and Polygon to compile the tally.

Borrowing continued to climb, but only one six-month period saw losses above 0.5% of the total borrowed via flash loans. The authors thus judge the threat to be serious and growing in sophistication, “but not existential.”

“We now are seeing crimes that we have never seen before and ones that are capable of stealing mind-boggling sums of money, often in the tens of millions of dollars,” Hall said in a university statement.

Hall also discussed a platform its attacker later taunted on social media, a tactic he said “led to some victims engaging with the attacker and outlining the devastating impacts that the loss of this money had on them.”

According to Cryptopolitan, in March 2026, Venus Protocol suffered a loss of over $3.7 million in an exploit built on low-liquidity THENA collateral. In April, a Sui-based lender named Scallop lost $142,000 after an attacker used a flash loan and an uninitialized variable in a deprecated rewards contract.