Let's start with the essential links: Binance Official Site, Official Binance App, Download Page. A flash loan attack exploits the flash loan — a DeFi primitive that lets you "borrow a large sum within a single transaction, as long as you repay it within that same transaction." The typical playbook is that the attacker borrows tens of millions to hundreds of millions of dollars, manipulates a price oracle or exploits a contract bug to profit, then repays the principal. As of the end of 2025, flash loan attacks have collectively cost DeFi protocols over $1.2 billion (sources: SlowMist / Rekt News).
A flash loan is a "zero-collateral, large-sum loan" offered by protocols like Aave, dYdX, and Equalizer. The rule is extremely simple: you must borrow and repay within the same blockchain transaction, or the entire transaction gets rolled back. This feature lets a borrower move tens of millions of dollars with zero collateral — but it also turns into a "cost-free weapon" for attackers.
The standard flash loan attack flow:
The flash loan itself isn't the vulnerability — the vulnerability is in the protocol being attacked. A flash loan simply drops the capital threshold for "price manipulation," which used to require hundreds of millions of dollars in traditional markets, down to almost zero, letting any attacker who understands a contract's logic give it a try.
The first-ever flash loan attack. The attacker borrowed 10,000 ETH from dYdX, manipulated the sUSD/ETH price on Uniswap, and used the distorted price to take out an under-collateralized loan from bZx, netting around $350,000. The dollar amount was small, but it kicked off the "flash loan attack" era.
The attacker used Curve's Y Pool to manipulate the USDC price, then deposited into and withdrew from Harvest's fUSDC pool at the manipulated low and high prices for profit. Harvest was a leading "yield vault" protocol at the time, and the attack drove its TVL from $1 billion down to $300 million within a week.
The attack hit Cream the day after Yearn's protocol was attacked. The attacker manipulated the yUSDVault price and borrowed an outsized amount from Cream in a single transaction. The protocol was badly wounded, with TVL falling to 5% of its peak.
The attacker combined a reentrancy bug in Rari with flash-loan price manipulation to drain funds from multiple Fuse pools. The incident directly led to Rari and Fei Protocol merging and then dissolving.
One of the most creative attacks on record: the attacker borrowed a huge sum of stablecoins via flash loan, then used the STALK governance token to push a malicious proposal through Beanstalk DAO's vote that transferred all of the protocol's funds to the attacker. Beanstalk's governance design had a fatal flaw — there was no timelock, so proposals could be executed immediately.
Attacker Avraham Eisenberg traded against himself on Mango Markets, using flash loans to pump the MNGO token's price 5-10x, then used the inflated MNGO as collateral to borrow out the protocol's real assets. Avraham was later charged by the SEC and CFTC and convicted of market manipulation in 2024.
The Euler lending protocol was hit through an "uncollateralized donation" bug. The attacker engineered a scenario that triggered an abnormal self-liquidation, draining a large amount of funds from the protocol. Dramatically, the attacker later returned most of the funds — making this a textbook case of "white-hat intent vs. black-hat execution."
A "yield vault" protocol on BSC. The attacker used a flash loan to dump the BUNNY token, extracting an outsized amount of BUNNY rewards from the pool in the process. BUNNY dropped 96% that day, and while the protocol kept running, it was badly wounded.
Yearn v2's yDAI pool was hit by a flash loan that manipulated the price of Curve's 3pool, letting the attacker extract abnormal yield from yDAI. This was Yearn's first major security incident, and it accelerated the project's subsequent audits and restructuring.
Not a pure flash loan attack, but the attacker combined a signature-verification bug in the Wormhole bridge with flash-loan-style tactics to mint 120,000 wETH on the Solana side without ever real depositing the matching collateral on the Ethereum side. Jump Crypto injected capital to cover the shortfall, keeping Wormhole operational.
The table below shows DeFi losses from flash loan attacks by year (based on the SlowMist Rekt database):
| Year | Number of Incidents | Total Losses ($100M) | Notes |
|---|---|---|---|
| 2020 | 8 | ~0.7 | bZx kicked off the era |
| 2021 | 25 | ~4.5 | Cream / PancakeBunny |
| 2022 | 32 | ~4.0 | Beanstalk / Mango |
| 2023 | 28 | ~2.8 | Euler and several smaller incidents |
| 2024 | 22 | ~1.5 | Defenses improved, incident count fell |
| 2025 | 18 | ~0.8 | Continued downward trend |
2022 marked the peak of flash loan attacks, and since then, as audits have strengthened and price oracles have improved (such as Chainlink TWAP feeds), both the number and size of attacks have declined.
The table below summarizes several common flash loan attack patterns:
| Attack Pattern | Mechanism | Representative Case |
|---|---|---|
| Price oracle manipulation | Borrowing a large sum to dump or pump the price on a single DEX, affecting any protocol that sources its price from that DEX | Harvest, Cream |
| Governance vote attack | Borrowing a large amount of governance tokens and voting immediately, bypassing any timelock | Beanstalk |
| Reentrancy bug combo | Flash loan combined with a reentrancy function that causes the protocol's state to update incorrectly | Rari Capital |
| Self-trade pump | Pumping a token's price in a market where you act as your own market maker, then using it as collateral | Mango Markets |
| Cross-protocol arbitrage | Borrowing a large sum to trigger an arbitrage path across multiple protocols | Various smaller attacks |
| Abnormal state trigger | Borrowing a large sum to trigger an edge case the protocol never adequately tested | Euler |
The main engineering practices used to defend against flash loan attacks:
| Defense Measure | Purpose | Limitation |
|---|---|---|
| Time-weighted average price (TWAP) | Uses a 30-minute-plus average price instead of an instant price | Can still be manipulated with sustained effort |
| Multiple oracle feeds | Combines sources like Chainlink and Pyth | Adds protocol complexity |
| Price volatility circuit breakers | Pauses trading if a single block's price move exceeds a threshold | Disrupts normal trading |
| Governance timelocks | Delays proposal execution by 24-48 hours | Slows down emergency proposals too |
| Higher collateralization ratios | Requires 150%-200% collateral | Reduces capital efficiency |
| Reentrancy locks | The standard ReentrancyGuard modifier | Standard Solidity practice |
| Formal verification | Mathematically proves the contract logic is correct | Extremely costly |
| Ongoing audits | Multiple audit firms cross-checking each other | Can't guarantee 100% coverage |
No DeFi protocol is 100% immune to flash loan attacks. Best practice is to drive the probability of being attacked as low as possible, and to have an emergency fund or insurance mechanism in place in case an attack does happen.
How everyday users can defend themselves against flash loan attacks:
The legal status of flash loan attacks remains murky. Mango Markets attacker Avraham Eisenberg was the first flash loan attacker ever convicted — the SEC and CFTC charged him with market manipulation and fraud in late 2022, and he was found guilty by the Southern District of New York in 2024.
But many other flash loan attackers have never been prosecuted. The legal gray area exists mainly because:
Q: Is the flash loan itself a vulnerability? No. A flash loan is a legitimate feature designed by protocols like Aave and dYdX, widely used for arbitrage, liquidations, and collateral swaps. The vulnerability lies in the protocol being targeted — the flash loan just lowers the barrier to attempt an attack.
Q: Can ordinary users use flash loans? In theory yes, but it requires knowing how to write a smart contract. You can't initiate a flash loan through Aave's regular UI — you have to deploy a contract or call Aave's flashLoan function directly. Tools like Furucombo provide a visual interface that lets even moderately technical users run flash loan arbitrage.
Q: Are flash loan attackers geniuses? The attacks require solid smart contract knowledge, sharp mathematical/logical thinking, and strong code-auditing skills — it's not just luck. But many attackers aren't anonymous prodigies; identified cases have included Israeli nationals, Eastern Europeans, and Asian technical students.
Q: Can DeFi protocols fully defend against flash loan attacks? Not 100%, but the probability can be driven very low. Established, battle-tested protocols like Aave and Compound have significantly lower attack-success rates than newer protocols.
Q: Can an attacked protocol recover? It depends on the severity of the loss and how the team responds. Some protocols (Euler, Wormhole) recovered through emergency funding, while others (Cream, Beanstalk) were badly wounded. A few have shut down entirely.
Q: Can users get their money back after their protocol is attacked? It depends on the specifics. Sometimes the protocol compensates users from its treasury or outside funding, and if the attacker returns the funds (a white-hat scenario), users can also get their money back. In most cases, though, users lose some or all of their principal.
Q: Will flash loan attacks keep increasing? The trend is downward. As audits improve, oracles get upgraded, and attack patterns become widely understood, new protocols now factor in flash loan defense from the design stage. But new attack techniques continue to evolve.
Q: Which protocols are most vulnerable to flash loan attacks? Typically: 1) new protocols with small TVL and shallow liquidity; 2) protocols that rely on a single DEX as their price source; 3) protocols with missing or overly short governance timelocks; 4) protocols with complex contracts and insufficient auditing.
Q: How do you track flash loan attacks? Useful tools: Tenderly (contract simulation), Etherscan / Tronscan (transaction tracing), SlowMist (security monitoring), and Chainalysis (on-chain analysis). Security teams like SlowMist, PeckShield, and CertiK on X (Twitter) are typically the first to disclose incidents.
Q: Does DeFi insurance cover flash loan attack losses? Partially. DeFi insurance products from Nexus Mutual and InsurAce cover "smart contract vulnerability" risk, and qualifying incidents can be paid out. But premiums are high (2%-10% annualized), coverage isn't comprehensive, and claims can be a complex process.
Q: Is the loss data in this article accurate? It's compiled from public sources like Rekt News, SlowMist, and CertiK, and individual incident figures may be revised as attackers return funds or protocols take remedial action. Readers can check rekt.news for the latest figures.
Q: Is this article a tutorial or a warning? A warning. This article does not teach anyone how to carry out a flash loan attack — it's simply a review of historical incidents meant to help users understand DeFi risk. Any attack on a real protocol carries serious legal risk.
Data sources: Rekt News, the SlowMist security database, CertiK Skynet, PeckShield reports, post-mortems from the affected protocols themselves, and SEC/CFTC prosecution filings, as of April 2026. This article does not constitute investment advice.