A flash loan sounds like it should not be possible. A borrower with no collateral, no credit check, and no relationship with a lender can obtain a loan worth millions of dollars, use it however they like, and repay it moments later, all without the lender ever taking on any real risk. The trick is not financial. It is a property of how blockchain transactions work. On most blockchains, a transaction either completes entirely or it does not happen at all. There is no partial execution. A flash loan protocol uses that all or nothing guarantee to let someone borrow funds, do something with them, and repay the loan, all inside a single transaction that will simply be undone if the repayment step fails.
This mechanism was designed for legitimate uses, particularly arbitrage between decentralized exchanges and efficient debt refinancing. It has also become one of the most common tools behind large scale DeFi exploits, because it hands an attacker something that used to be their biggest obstacle: enough capital, for just long enough, to manipulate a market.
How a flash loan actually works
When a borrower requests a flash loan, the lending protocol transfers the requested funds immediately, before any collateral or repayment has been provided. The borrower's transaction then executes whatever logic it wants to run, a series of trades, deposits, or contract calls, using that borrowed capital. Before the transaction finishes, the protocol checks whether the loan, plus a small fee, has been returned. If it has, the transaction is finalized and the loan simply never appears to have carried any risk. If it has not been repaid, the entire transaction, including every trade and every contract call the borrower made along the way, reverts as though none of it ever happened. The blockchain's ledger looks exactly the same as it did before the attempt.
Because a failed flash loan simply reverts, an attacker faces essentially no financial downside for attempting an exploit. The only cost of a failed attempt is the small transaction fee paid to the network itself.
Why this enables attacks
Many DeFi exploits depend on temporarily controlling a large share of a market, enough to push a price, drain a liquidity pool, or accumulate enough governance tokens to pass a vote. Before flash loans existed, an attacker needed to already own that much capital, which is expensive and puts real money at risk if the attack fails. Flash loans remove that requirement entirely. An attacker with essentially no starting capital can borrow tens of millions of dollars for the few seconds a single transaction takes to execute, more than enough time to distort a price feed or overwhelm a pool, then repay the loan from the proceeds of the exploit itself.
The anatomy of a flash loan attack
The oracle manipulation path
The attacker borrows a large sum, uses it to make an outsized trade in a low liquidity pool that a target protocol uses as its price reference, causing that pool's reported price to swing sharply. The target protocol, reading that distorted price through its oracle, allows the attacker to borrow far more than they should be able to against overvalued collateral, or to trigger liquidations at an artificial price. The attacker then reverses the original trade, repays the flash loan, and keeps the difference. Our guide on how DeFi exploits happen covers oracle manipulation as one of several related attack categories.
The governance takeover path
Some protocols allow proposals to be voted on and executed within a short window, sometimes within a single transaction if enough voting power is temporarily held. An attacker borrows a large quantity of a protocol's governance token through a flash loan, uses that borrowed voting power to pass a proposal that benefits them directly, such as authorizing a transfer of treasury funds, executes it, and returns the borrowed tokens. A documented 2024 case involving the XToken protocol followed exactly this pattern, with an attacker borrowing governance tokens specifically to approve a proposal that sent funds directly to their own wallet.
The liquidity and accounting path
Not every flash loan attack relies on price manipulation. Some exploit rounding errors or flawed accounting logic in how a protocol tracks deposits, withdrawals, or liquidity positions. A large, temporary deposit funded by a flash loan can expose a rounding discrepancy that would be far too small to matter at ordinary transaction sizes, but becomes profitable once amplified by tens of millions of dollars in borrowed capital moving through the same flawed calculation.
Real world examples
- In January 2024, Radiant Capital lost approximately four and a half million dollars in a flash loan attack that exploited a known rounding issue present in code shared across several major lending protocols.
- In September 2025, Bunni, a decentralized exchange built on Uniswap v4, lost roughly eight and a half million dollars in a flash loan assisted exploit spanning Ethereum and a connected network, targeting a precision error in how its liquidity pools calculated balances.
- Security researchers tracking April 2025 alone recorded ninety two million dollars in losses across fifteen distinct incidents, a majority of which involved flash loans as part of the attack chain, representing more than double the losses recorded the previous month.
Across 2025 as a whole, industry trackers recorded total cryptocurrency losses to hacks and scams exceeding one point seven billion dollars, already surpassing the total recorded for the entirety of the previous year, with flash loan assisted exploits contributing a meaningful and recurring share of that figure month over month rather than appearing as an isolated event.
Why newer and smaller protocols are especially exposed
Flash loan attacks disproportionately target protocols that are newer, smaller, or rely on thinner liquidity, for a simple reason: the less liquidity a pool holds, the less capital an attacker needs to move its reported price significantly. A protocol with deep, well established liquidity across multiple independent price sources is comparatively expensive to manipulate, since a flash loan large enough to meaningfully move the price would need to be correspondingly larger, cutting into the attacker's eventual profit. A newly launched pool with a modest amount of liquidity, by contrast, can sometimes be pushed to an extreme price with a flash loan that costs the attacker only a small transaction fee to arrange, which is part of why so many flash loan incidents cluster around protocols that have been live for only weeks or months rather than years.
Why this is not a legal gray area
Because a flash loan attack technically only calls functions the smart contract itself allows, it is sometimes mistakenly described online as clever trading rather than theft. That framing is misleading. The attacker is exploiting a flaw the protocol's designers did not intend, to take funds that belong to other users and liquidity providers, without their consent. Regulators and law enforcement in the United States and elsewhere have treated large flash loan exploits as theft and fraud, not as a legitimate use of the protocol.
How this complicates recovery
A successful flash loan attack completes in a single transaction, meaning by the time anyone notices unusual activity, the exploit is already finished and the proceeds are sitting in the attacker's wallet. From there, funds typically move quickly through cross chain routes to complicate any follow up investigation. Our guide on how blockchain tracing works explains how analysts reconstruct this kind of transaction chain after the fact, even when the attack itself happened in seconds.
Protective measures for protocols and users
- Protocols increasingly use time weighted average price oracles instead of instantaneous spot prices, making a single large trade far less effective at distorting the reported price.
- Reentrancy guards and the checks effects interactions coding pattern reduce the chance that a flash loan funded call can exploit a sequencing flaw.
- Time locks on governance proposal execution prevent a borrowed voting position from being used and reversed within a single transaction.
- Users evaluating a new protocol should review whether it has undergone a recent, reputable audit and check for the warning signs covered in our guide on DeFi contract red flags.
Frequently asked questions
No. Flash loans are a standard, widely used DeFi feature with legitimate purposes such as arbitrage and debt refinancing. It is the use of a flash loan to manipulate a price, exploit a coding flaw, or seize control of a protocol's governance that constitutes an attack, not the loan mechanism itself.
The loan and the exploit happen within the same transaction, which either completes entirely or reverts entirely. There is no window between the loan being issued and the exploit occurring in which a protocol can intervene, since from the blockchain's perspective it is all a single, instantaneous event.
Very little of their own capital. The attacker needs only enough to cover network transaction fees and the flash loan's own small fee, typically a fraction of a percent of the borrowed amount. The scale of the attack is limited by how much liquidity is available to borrow, not by the attacker's own resources.
Sometimes, though it is far from guaranteed. Some protocols have negotiated the return of funds by offering the attacker a bug bounty in exchange for giving back the rest, while others have pursued the exploit as a criminal matter through law enforcement once the funds reached a traceable off ramp.
Sources and further reading
- SC07:2025 Flash Loan Attacks · OWASP Smart Contract Security
- Flash Loan Attacks: How They Work, Real Examples, and How to Prevent Them · Hacken
- Year in Review: The Biggest DeFi Hacks of 2025 · Halborn