Logic flaws overtook price-feed manipulation as the costlier kind of DeFi flash loan attack
Researchers Tim Hall and Remo Stieger found protocol logic exploits caused 55% of DeFi flash loan losses from 2022 to mid-2024, up from 28% before. For an investor, diligence on a DeFi position moves from price feeds to the design of the contracts themselves.
The Investor · Invest desk
What happened
- Flash loan attacks were 72 of the 254 successful DeFi attacks from February 2020 to July 2024, accounting for 18.44% of the $6.568 billion lost.
- The researchers sorted 14 attack types into two groups, price-feed manipulation and flaws in protocol logic, and found logic exploits rarer but costlier on average.
- Price oracle attacks, donate-function logic exploits, reentrancy attacks and a single $181 million governance attack made up more than 81% of flash loan losses.
- More than 80% of the flash loan losses occurred on Ethereum, the study found.
Why it matters
- What it limits constraint The logic-versus-oracle split covers only the flash loan slice. The other $5.357 billion of DeFi exploit losses, about 82% of the total, needs its own breakdown before it can direct a diligence budget.
- What it costs cost Bunni closed in October 2025 after an $8.4 million flash loan exploit. It could not afford a secure relaunch. An investor has to price a protocol's ability to pay for recovery alongside the bug.
- What it sets up precedent Hall said the analysis has "a host of applications for the cryptocurrency industry, for regulators and for legal and law enforcement agencies." This peer-reviewed tally is likely to be cited when DeFi losses come up in enforcement and rule-making.
Next story · Invest · 2h ago
Tokenized stock trading grew 55-fold in 2026 against a sixfold rise in value, DWF Labs findsConfirmed3 publishers
Divided out, the flash loan attack was the smaller kind of DeFi exploit. The 72 incidents averaged about $16.8 million each [19], against roughly $29.4 million for each of the other 182 successful attacks [20]. The researchers drew the sample from 20.63 billion transactions on seven blockchains [13].
Within the category, the mix turned over. The two groups cover all 14 attack types the researchers identified [8]. Take logic out, and price-feed manipulation fell from about 72% of flash loan losses in the period to January 2022 to about 45% in the period to July 2024 [21]. The authors say the cycles of growth and consolidation suggest platforms fixed what had been hit while attackers went looking for new flaws [12].
One reading of those numbers is that oracle defences matured and the money now sits in contract logic, where it will stay. The second is concentration. Attacks of $10 million or more made up over 88% of losses, with individual hits running from $80,000 to $197 million [11]. The one governance attack was about 15% of the four-year flash loan total by itself [22]. A period share built on a few large incidents can swing back with the next big oracle exploit. The third is scale. Losses topped 0.5% of the value borrowed through flash loans in only one six-month period, while use kept growing [4]. The authors call the attacks significant but "not existential" threats [5].
I think the first reading is mostly right, or rather right about where the losses went and weaker on what a review can do about them. The authors describe the attacks as increasingly sophisticated [5], and Hall said in a statement that "we now are seeing crimes that we have never seen before" [6]. The victim platform the researchers interviewed put it differently. From a blockchain security perspective, the attacks by professional state-level and organized crime groups "are not at all advanced," its representative said [16]. That platform's own bug had passed "ourselves and several of the auditors," the representative said, and went unnoticed on-chain for more than a year [15].
A fund that moves its review hours to protocol design is aiming them at the group of attacks that now costs the most [21]. It also has to stop treating an audit report as clearance. The one victim the paper interviewed had passed several audits before it was hit [15].
What to watch
- Post-July 2024 incident data collected the same way, to test whether logic exploits stayed above half of flash loan losses.
- Incident counts behind each period's loss share, showing whether two or three attacks of $10 million or more drive the move from 28% to 55%.
Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+15
- Incentives35
- Confidence60
Perspective Coverage
3 publishers- Builder
- Builder 35%
- Operator
- Operator 32%
- Investor
- Investor 33%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Flash loan attacks caused $1.211 billion in losses across 72 incidents between February 2020 and July 2024, according to a study in the Journal of Financial Crime.
- [2]
Flash loan attacks were 72 of 254 successful attacks on DeFi between February 2020 and July 2024; the 254 attacks caused $6.568 billion in losses, 18.44% of which came from flash loan attacks.
- [3]
The study was written by Professor Tim Hall of the University of Winchester and Remo Stieger, a former partner at Swiss risk intelligence firm SyntiFi.
- [4]
Losses exceeded 0.5% of the value borrowed through flash loans in only one six-month period, and flash loan use kept growing.
- [5]
The authors characterize flash loan attacks as significant, increasingly sophisticated and unpredictable "but not existential" threats to DeFi.
- [6]
Hall said in a statement that "we now are seeing crimes that we have never seen before."
- [7]
"The analysis we did has a host of applications for the cryptocurrency industry, for regulators and for legal and law enforcement agencies," Hall said.
- [8]
The researchers identified 14 types of flash loan attack in two broad groups: those that manipulate price feeds and those that exploit flaws in a protocol's underlying logic. Logic exploits were less frequent but caused higher average losses.
- [9]
Logic exploits accounted for 28% of flash loan attack losses between February 2020 and January 2022, and 55% from February 2022 to July 2024.
- [10]
Four attack types accounted for more than 81% of flash loan losses: price oracle attacks, donate function logic exploits, reentrancy attacks and a single governance attack, which cost $181 million.
- [11]
Individual flash loan attacks ranged from $80,000 to $197 million, and those that stole $10 million or more accounted for over 88% of losses.
- [12]
Attack activity moved through phases of growth and consolidation, which the authors write suggests platforms improved their security after attacks while attackers found new vulnerabilities.
- [13]
The researchers combed through 20.63 billion transactions across seven blockchains, including Ethereum and BNB Chain.
- [14]
More than 80% of flash loan attack losses occurred on Ethereum, the study found.
- [15]
The bug exploited at the interviewed platform had passed "ourselves and several of the auditors," the platform's representative said, and went unnoticed on-chain for more than a year.
- [16]
From a blockchain security perspective, the professional state-level or organized crime groups' attacks "are not at all advanced," the representative said.
- [17]
Decentralized exchange Bunni shut down in October 2025 after an $8.4 million exploit that used flash loans, saying it could not afford the cost of a secure relaunch.
- [18]
Non-flash-loan DeFi attacks caused about $5.357 billion of losses across 182 attacks, about 82% of the $6.568 billion total.
- [19]
The average flash loan attack caused about $16.8 million in losses.
- [20]
The average non-flash-loan DeFi attack caused about $29.4 million in losses.
- [21]
Price-feed manipulation accounted for about 72% of flash loan losses from February 2020 to January 2022 and about 45% from February 2022 to July 2024.
- [22]
The single $181 million governance attack was about 15% of all flash loan losses in the study period.
Sources
3 independent publishers whose own reporting we read for this story.
- cryptobriefing.comFlash loan attacks drained $1.211 billion from DeFi, University of Winchester study finds
1 article · October 6, 2026
- cryptopolitan.comDeFi flash loan attacks shifted to protocol logic flaws, which caused 55% of losses by 2024
1 article · October 6, 2026
- decrypt.coFlash Loan Attacks Drained $1.2B From DeFi Between 2020 and 2024: Study
1 article · October 6, 2026
Topics and entities
Topics
- Price oracle manipulation
- DeFi Security
- Flash loan attacks