Flash Loan Attacks on DeFi Protocols: How They Work and How to Stop Them

25 September 2025

On April 12, 2022, a single blockchain transaction wiped out $182 million from Beanstalk Farms. No physical break-in. No stolen private keys. Just a flash loan and a clever exploit. That’s the power-and danger-of flash loan attacks in DeFi.

What Exactly Is a Flash Loan?

A flash loan is a type of unsecured loan unique to decentralized finance. Unlike traditional loans, you don’t need collateral. You don’t need a credit check. You don’t even need to wait for approval. All you need is enough gas to pay for the transaction.

The catch? You have to repay the entire loan-plus a small fee-within the same blockchain block. That’s about 12 to 15 seconds on Ethereum. If you don’t repay it, the whole transaction reverses, like it never happened. Smart contracts enforce this rule automatically.

Flash loans were originally designed to help traders arbitrage price differences between exchanges. But bad actors quickly realized they could use them to manipulate markets. And that’s where the trouble starts.

How Flash Loan Attacks Work

Here’s how a typical flash loan attack unfolds:

1. Borrow a massive amount of a token-say, $100 million in DAI-from a flash loan provider like AAVE.
2. Swap that DAI for another token, like WETH, on a decentralized exchange (DEX) like Uniswap. By dumping so much DAI, you crash its price on that exchange.
3. Use the manipulated price as collateral on a lending protocol. Because the system thinks your WETH is now worth way more (due to the fake price), you can borrow far more DAI than you should be allowed to.
4. Take the extra DAI you just borrowed, swap it back to WETH at the real market price (which hasn’t changed yet), and pocket the difference.
5. Repay the original flash loan and walk away with millions in profit. The transaction is reversed only if repayment fails. Since you repaid it, the system accepts it as valid.

It’s like borrowing a Ferrari, driving it into a wall, claiming insurance for the damage, then returning the car undamaged-and keeping the payout. The system doesn’t notice because everything happens in one atomic transaction.

Real Attacks, Real Losses

These aren’t theoretical threats. They’ve cost millions-and sometimes hundreds of millions.

In 2022, the Beanstalk Farms attack used a flash loan to manipulate governance votes. The attacker borrowed $1 billion, used it to gain control of the protocol’s voting power, and then approved a malicious proposal that drained $182 million from the treasury.

The PancakeBunny exploit in 2021 saw attackers manipulate the price of BUNNY tokens using flash loans, then sell them off, crashing the token’s value and wiping out $200 million in user funds.

Even in 2025, the pattern continues. In March, KiloEx lost $7 million when attackers manipulated price feeds across its liquidity pools. And according to blockchain analytics firm Amberdata, flash loan attacks accounted for nearly 40% of all DeFi exploits in Q1 2025.

Why Are These Attacks So Hard to Stop?

Three reasons:

1. Speed: Everything happens in one block. By the time a monitoring tool detects the anomaly, the attacker has already cashed out.
2. Accessibility: You don’t need to be a hacker with years of experience. Just know how to write a simple smart contract and have enough ETH for gas fees. Many attackers are automated bots.
3. Reliance on oracles: Most DeFi protocols use price feeds from decentralized oracles to determine asset values. If those oracles pull data from a single DEX, they’re vulnerable to manipulation. A $10 million trade can distort the price for minutes-and that’s all an attacker needs.

How Protocols Are Fighting Back

The good news? The DeFi community isn’t sitting still. Here’s what’s working:

• Time-Weighted Average Price (TWAP): Instead of using the current price, protocols now calculate the average price over the last 5 to 15 minutes. This makes it nearly impossible to manipulate prices with a single large trade.
• Multi-oracle systems: Leading protocols like AAVE and Compound now pull price data from at least three different sources-Uniswap, Chainlink, SushiSwap, etc. If one feed is tampered with, the others act as checks.
• On-chain data feeds: Some protocols now use first-party oracles that publish data directly from their own liquidity pools, reducing reliance on third-party feeds.
• Circuit breakers: Protocols like Euler Finance now pause trading if price movements exceed 5% in a single block. It’s not perfect-it can slow down legitimate trades-but it stops the worst attacks.
• Code audits and formal verification: Projects like Yearn and Balancer now require multiple independent audits before launching. Tools like Slither and MythX scan for reentrancy bugs, access control flaws, and logic errors before code goes live.

What You Can Do as a User

If you’re providing liquidity or using DeFi protocols, here’s how to protect yourself:

• Avoid protocols with single-price oracles. If a project only uses one DEX for price data, it’s a red flag.
• Check for TWAP. Look for mentions of “time-weighted average price” in the documentation or whitepaper.
• Use audited protocols. Stick to projects that have published audit reports from firms like CertiK, OpenZeppelin, or Trail of Bits.
• Monitor your positions. If you’re a liquidity provider, watch for sudden spikes in trading volume or price volatility. It could signal an attack in progress.

The Bigger Picture

Flash loan attacks aren’t going away. They’re becoming more sophisticated. In 2025, some attackers are using AI to simulate attack scenarios and find hidden vulnerabilities before deploying exploits. Others are coordinating across multiple chains to bypass single-chain protections.

But the ecosystem is adapting. Insurance protocols like Nexus Mutual and Cover Protocol now offer coverage against flash loan exploits. Regulatory bodies in the EU and Singapore are starting to look at DeFi security as part of broader financial oversight.

The bottom line? Flash loans themselves aren’t bad. They’re a powerful tool. But like any tool, they can be misused. The future of DeFi depends on building systems that are not just decentralized-but also secure, resilient, and smart.