Flash loan attacks siphoned $1.2 billion out of decentralized finance between 2020 and 2024, according to researchers who scanned more than 20 billion transactions to piece together the pattern of exploits. The findings paint a picture of an attack method that got both more sophisticated and harder to predict as the years went on.
Mapping 20 billion transactions
The scale of the analysis is the first thing that stands out. Twenty billion transactions is not a sample — it's effectively the entire on-chain history of the period under review. By running that volume through their detection methods, the researchers weren't relying on a handful of high-profile cases or community-reported incidents. They were looking for the full population of flash loan attacks, including the ones that never made headlines.
That matters because flash loan exploits are easy to miss in real time. A borrower takes out an uncollateralized loan, executes a series of trades or contract calls within a single transaction block, and repays the loan — all before anyone has time to react. If the sequence works, the attacker walks away with funds. If it fails, the transaction reverts and, on the surface, nothing happened. Only a systematic scan of block-level data can separate the successful attacks from the failed attempts and the ordinary arbitrage that uses the same mechanics.
Why the attacks got harder to see coming
The study's other headline finding is that flash loan attacks didn't just persist over the 2020–2024 window — they grew more sophisticated and less predictable. Early attacks often followed recognizable patterns: manipulate a price oracle on one exchange, profit on another, repeat. As protocols hardened those specific vectors, attackers adapted. The result is a threat landscape where the old heuristics — the ones that made some attacks detectable in advance — stopped working as reliably.
Less predictable doesn't necessarily mean more frequent. It means the warning signs shifted. A pattern that held for months could suddenly stop being a reliable indicator, and a new one could emerge without much notice. For the people building monitoring tools, that's a difficult problem. Detection systems trained on historical attack signatures have to keep up with adversaries who are actively working to avoid those same signatures.
The $1.2 billion figure covers the whole four-year stretch. It doesn't break down by year in the facts released, and the researchers haven't framed it as a record or a trend line. What they've established is a floor: this is what a full-population scan of on-chain activity can attribute to flash loan attacks over that period.
What protocols are left to work with
Flash loans themselves aren't the problem. They're a legitimate DeFi primitive — a way to borrow large sums without collateral as long as the loan is repaid in the same transaction. The attacks exploit that same feature, which means any fix has to preserve the legitimate use case while raising the cost of the malicious one.
That tension is why the study's findings are likely to land differently depending on who's reading them. For protocol developers, the takeaway is that static defenses tied to specific attack patterns have a shelf life. For the researchers, the work establishes a baseline that future scans can be measured against. And for anyone holding funds in DeFi protocols, the $1.2 billion figure is a reminder that the threat isn't theoretical — it's already been extracted from the ecosystem, one transaction at a time.
The researchers haven't said what comes next: whether they plan to extend the scan to 2025, release the underlying dataset, or publish the detection methods so other teams can reproduce the results. Those details would matter for anyone trying to build on the work. For now, the study stands as a measurement of what happened between 2020 and 2024 — and as evidence that the attack method didn't fade as DeFi matured. It adapted.
