Hackers Stole $1.2 Billion From Crypto Using 'Flash Loan' Attacks

A new type of cybercrime is stealing "mind-boggling sums" from the world of digital finance. A recent study published in the Journal of Financial Crime found that so-called "flash loan attacks" stole $1.211 billion between February 2020 and July 2024.

First, let's break down the jargon. DeFi (decentralized finance) is a type of financial service that runs on blockchain technology, without banks or middlemen. A flash loan is a special kind of loan where you can borrow a huge amount of money with no collateral (no security deposit) — as long as you pay it all back within the same split-second transaction. Attackers use these giant loans to exploit weaknesses in the system and steal funds.

Here are the key numbers from the research:

• $1.211 billion stolen across 72 separate attacks
• That's 18.44% of the total $6.568 billion lost to all DeFi attacks in the period
• Over 80% of flash loan losses happened on Ethereum (the second-biggest cryptocurrency and a popular platform for DeFi apps)
• Individual attacks ranged from $80,000 to $197 million
• Attacks stealing $10 million or more made up over 88% of all losses

The researchers found 14 types of attack, split into two main groups: those that trick price systems (price oracle attacks — where hackers fool a platform about the real value of an asset), and those that exploit flaws in how the software is coded. The code-based attacks were rarer but far more expensive.

One anonymous victim said the bug used against them had slipped past their own team and "several auditors," staying hidden for over a year. Attackers reportedly even taunted victims on social media afterward.

The takeaway: Researchers describe these attacks as growing, increasingly sophisticated, and unpredictable — but "not existential" threats to DeFi. Still, the damage is real: in October 2025, the exchange Bunni shut down completely after an $8.4 million flash loan exploit.

This is an AI-generated summary. Read the original article at: https://decrypt.co/380166/flash-loan-attacks-drained-1-2b-from-defi-between-2020-and-2024-study