Flash Loan Attack

A flash loan attack is an exploit in decentralized finance in which an attacker uses a flash loan, a large loan that needs no collateral but must be repaid within one transaction, to take advantage of a weakness in another protocol. The borrowed money lets the attacker move prices, gain voting power or trigger faulty contract logic on a scale they could not afford otherwise. Profits are extracted, the loan is repaid and the attacker keeps the difference, all within seconds.

The flash loan is the tool rather than the flaw. The weakness usually lies in how the target protocol prices assets, counts votes or tracks balances. Such attacks have caused losses running into hundreds of millions of dollars since 2020, and they have shaped how DeFi developers design price feeds and governance systems. Legally, many jurisdictions treat them as theft, fraud or market manipulation, although the attackers often argue they simply used the code as written.

Imagine a pawn shop that decides what gold is worth by asking the jeweller next door for a single quote. A trickster borrows a huge sum for five minutes, buys up the jeweller's entire stock to drive the quoted price sky-high, then pawns a little gold at the inflated value, walks off with the cash, sells the jeweller's stock back and repays the loan. The pawn shop is left holding gold worth far less than it paid.

The trick only works because the pawn shop trusted one easily moved price, and because the borrowed money made the price easy to move. In DeFi, the "five minutes" is a single transaction, and the whole sequence is carried out by code.

• Price oracle manipulation. The attacker uses borrowed funds to make a large trade in a thin pool on a decentralized exchange, distorting its price. A lending or derivatives protocol that reads that pool as its price oracle then lets the attacker borrow too much against collateral or redeem tokens at the wrong price.
• Governance capture. Where voting power is based on tokens held at the moment of a vote, a flash loan can supply enough tokens to pass a malicious proposal, as long as the vote executes in the same transaction.
• Logic and accounting bugs. Large, short-lived balances can expose rounding errors, faulty reward calculations or reentrancy flaws that would be unprofitable to exploit with small sums.

The lending protocol bZx suffered two attacks in February 2020 that used flash loans to manipulate prices, among the first widely reported cases. In May 2021, an attack on the yield platform PancakeBunny on BNB Chain manipulated pool prices to mint large amounts of its reward token, which then collapsed in price. In April 2022, an attacker used a flash loan to acquire a majority of voting power in the Beanstalk stablecoin protocol and passed a proposal that transferred its reserves, causing losses of about $180 million. In March 2023, Euler Finance lost close to $200 million through a flaw in its lending logic exploited with flash loans; most of the funds were later returned after negotiations. Reported loss figures vary by source and by the token prices used.

• Robust price feeds. Protocols use time-weighted average prices or decentralized oracle networks such as Chainlink, which are far harder to move within a single transaction.
• Governance delays. Requiring tokens to be locked or held before a snapshot, and adding a time delay before approved proposals take effect, blocks same-transaction vote capture; see governance token.
• Audits and testing. Independent audits, formal verification and simulations with extreme balances help reveal logic flaws before launch.
• Bug bounties and monitoring. A bug bounty rewards researchers for reporting flaws, while monitoring tools can pause contracts when unusual activity appears.

After an attack, the drained funds usually pass through many wallets, cross-chain bridges or a crypto mixer. Teams sometimes negotiate with attackers, offering a "bounty" for returning most of the money, and some exploiters have accepted. Courts have also begun to rule on whether exploiting code counts as a crime. In a notable US case concerning the Mango Markets exchange, a trader was convicted in 2024 of fraud and manipulation over a price-manipulation exploit, though the conviction was later overturned by the trial judge in 2025. The case shows that the law in this area is still unsettled. Users of DeFi protocols bear the losses directly when attacks succeed, which is why reviewing a protocol's audit history and oracle design forms part of sensible DeFi risk assessment.