Flash Loans: The Money Lenders Never Risk
In 2024, flash loan transaction volume surpassed $2 trillion, establishing flash loans as a key mechanism for maintaining capital efficiency across DeFi markets.
Flash loans are one of the most fascinating implementations of the Decentralized Finance (DeFi) promise—instant, collateral-free lending enabled by smart contracts.
Flash loans allow users to borrow crypto without any collateral, but they have to pay back the loan in the same block. If they don’t, the whole trade is canceled. So the lender doesn’t take on any risk; either the loan is repaid instantly, or it never existed.
What Can Be Done Within One Block
Despite their limitations, flash loans have become a significant element of DeFi. They interconnect the whole DeFi ecosystem and effectively help it stay more efficient.
Flash loans are used for a few use cases: arbitrage, liquidations and liquidity management.
Arbitrage is one of the most significant use cases for flash loans (around 75% of all flash loans). There are multiple decentralized exchanges in the Ethereum ecosystem that allow users to create pools and swap tokens. The result is a vast number of DEX pools, many of which overlap in token pairs, creating price discrepancies between pools. Ethereum’s composability allows crypto bots to effectively use flash loans to profit from these arbitrage opportunities and balance prices across exchanges.
Bots can borrow significant amounts of money to capitalize on arbitrage opportunities without the need to hold liquidity for these trades. There are even instances where trading bots borrow hundreds of millions of dollars to secure only a few dollars in profit.
Similarly to arbitrage, flash loans can be effectively used with liquidations. If a borrower’s collateral ratio falls below a threshold, they become eligible for liquidation. A liquidator steps in, borrows funds via a flash loan, repays the borrower’s debt, claims the collateral, and sells it—all within one transaction.
DeFi protocols often need rebalancing or refinancing positions. Here also, flash loans can be used to move funds between protocols to optimize yield or replace one type of collateral with another.
Although flash loans are mainly used by experienced traders and developers with deep technical knowledge, their volume on EVM chains surpassed $2 trillion in 2024 and is likely to keep growing alongside the DeFi market.
Flash Loan Attacks Make DeFi Stronger
Finally, while this technology was designed for good purposes, it has also been used by bad actors. There have been many instances where hackers implemented so-called “flash loan attacks” on DeFi protocols. In a flash loan attack, the attacker uses a flash loan to manipulate a protocol and steal funds, all within a single transaction. As mentioned earlier, flash loans give attackers access to large amounts of capital instantly and without collateral, which can be used to exploit weaknesses in smart contracts’ logic and price mechanisms. Since 2018, DeFi protocols have lost hundreds of millions of dollars due to flash loan attacks.
bZx Protocol Attacks (2020) Loss: ~$1 million
Attackers used flash loans to borrow assets and manipulate oracle prices. After that, using the false prices, they drained money from the protocol.
This was one of the first major attacks that showed how flash loans could be used to manipulate DeFi mechanics.
Harvest Finance (2020) Loss: ~$34 million
Flash loans were used to manipulate the price of USDT and USDC stablecoins on Curve Finance. That tricked Harvest into thinking certain assets were worth more than they were and let attackers withdraw more money than was actually deposited.
Alpha Homora + Cream Finance (2021) Loss: ~$37 million
An attacker used a complex chain of flash loans and interactions across multiple protocols to exploit a vulnerability in Alpha Homora’s lending logic. It was one of the most technically advanced attacks involving flash loans at the time.
PancakeBunny (2021) Loss: ~$45 million
Attackers used flash loans to manipulate the price of BUNNY token through a series of swaps, dump the inflated tokens on the market and crash the token’s price.
Platypus Finance – October 2023 Loss: ~$2.2 million
Platypus, a StableSwap protocol on the Avalanche network, experienced its second flash loan attack in nine months. Attackers exploited vulnerabilities to drain approximately $1.3 million in wrapped AVAX (WAVAX) and about $913,000 in liquid staked AVAX (sAVAX).
Radiant Capital Flash Loan Exploit — January 2024 Loss: ~$4.5 million
By initiating a flash loan, the attacker manipulated the liquidity index, allowing them to repeatedly deposit and withdraw funds, effectively siphoning off approximately $4.5 million worth of ETH
Gamma Strategies (Arbitrum) – January 2024 Loss: ~$3.43 million
A flash loan attack targeted the Gamma Strategies contract on the Arbitrum chain. The attacker manipulated prices to extract 1,535 ETH, worth approximately $3.43 million, which was then bridged to Ethereum.
Dough Finance – July 2024 Loss: ~$1.8 million
An attacker exploited a vulnerability in Dough Finance's smart contract, which failed to properly validate incoming data during flash loan calls. Utilizing the zero-knowledge protocol Railgun, the attacker manipulated the system to steal funds, swapping stolen USDC for 608 Ether (ETH).
Moonwell DeFi – December 2024 Loss: ~$320,000
Moonwell DeFi, operating on the Optimism network, suffered a flash loan exploit targeting its USDC lending contract. The attacker used a malicious contract disguised as an "mToken" to gain unauthorized token approvals, draining funds from users. The stolen USDC was swapped for DAI, and the attacker utilized Tornado Cash to obfuscate the transaction trail.
While these attacks are often called flash loan attacks, they actually represent legitimate exploits of DeFi application bugs that could otherwise be performed with significant capital. Thus, flash loans are helping rather than damaging the development of DeFi products and infrastructure.
Across all use cases, there are, on average, 200,000 flash loan transactions daily on EVM chains.
Where To Get Flash Loans?
Currently, on Ethereum, there are a number of platforms that provide flash loan services. Among the biggest ones are Balancer, Aave, dYdX, and Uniswap. However, the most volume comes from Balancer and Aave. Aave generates $30–50 million in flash loan volume on average, while Balancer sees $1–2 billion in daily flash loan volume.
The numbers clearly show that flash loans are essentially the lifeblood of the DeFi market, providing capital efficiency across the ecosystem. With the continued growth of the DeFi market, flash loans are expected to play an even more central role in its evolution.