A newly published academic study estimates that flash loan attacks stripped more than $1.21 billion from decentralized finance (DeFi) between February 2020 and July 2024 — a window of roughly four and a half years. The research was released in the Journal of Financial Crime, a peer-reviewed journal covering fraud, money laundering, and other financial crime across traditional and digital-asset markets.

Flash loans are a DeFi-specific lending mechanism: uncollateralized loans that must be borrowed and repaid within a single blockchain transaction. If repayment does not occur before the transaction ends, the entire transaction reverts, meaning lenders take on no credit risk. That same mechanic, however, has been used as an attack vector — an attacker can borrow a large amount for the duration of one transaction, use it to manipulate prices or exploit flaws in a protocol's smart contracts, and repay the loan before the transaction closes.

According to the study's tally, more than 80% of the total damage from these attacks landed on Ethereum (ETH), the smart contract platform that hosts the largest share of DeFi protocols and on-chain liquidity.

For readers tracking DeFi security, the study offers a quantified, peer-reviewed baseline for a category of exploits that depends on borrowed liquidity rather than stolen keys or upfront capital. The full study is available in the Journal of Financial Crime.

The findings were reported by COINOTAG on October 6, 2026. This content was first published on COINOTAG: https://en.coinotag.com/ethereum-flash-loan-attacks-1-21b-study