A study in the Journal of Financial Crime finds 254 successful DeFi attacks from February 2020 through July 2024, totaling $6.568 billion in losses, with flash loan attacks making up about one-fifth of that amount.

Flash loan attacks account for $1.211 billion across 72 incidents, representing roughly 18.4% of total DeFi losses in the period.

The research is the first to combine criminological methods with on-chain risk analysis and multiple data sources to map the nature, extent and patterns of DeFi attacks.

Professor Hall notes this integrative approach blends criminology with on-chain data to offer a comprehensive view of attacker behavior and systemic risk in DeFi.

Using On-chain Risk Intelligence from SyntiFi, the study analyzes 20.63 billion blockchain transactions across seven major chains where flash loans exist, including Ethereum, Base and Polygon.

The University of Winchester team, led by Professor Tim Hall, identifies a new wave of DeFi cybercrime pushing losses into the billions.

A victim platform is shown with attackers taunting the team on social media, underscoring the real-world impact on investors losing millions.

Attacks fall into two categories: price feed manipulations (oracle attacks) and protocol logic exploits; the latter grew from 28% of losses (Feb 2020–Jan 2022) to 55% (Feb 2022–Jul 2024), though they were less frequent.

More than 80% of flash loan losses occurred on Ethereum, with per-attack losses ranging from tens of thousands to nearly $200 million, and attacks of $10 million or more accounting for over 88% of losses.

Four attack types—price oracle attacks, donate function exploits, reentrancy, and a governance attack totaling $181 million—together account for over 81% of losses.

Researchers stress practical implications for the crypto industry, regulators, and law enforcement, with plans to disseminate a briefing paper and broaden insights within the DeFi sector.

The study comes amid ongoing security pressures in DeFi, highlighted by later events such as a major exploit that led to a shutdown of a prominent DEX in October 2025.