GoKawiilStudy: DeFi flash loan exploits now target protocol logic, not price oracles
A peer-reviewed study in the Journal of Financial Crime examined 72 flash loan attacks between February 2020 and July 2024 that drained $1.211 billion from DeFi platforms, part of 254 total attacks costing $6.568 billion across 20.63 billion transactions on seven blockchains. The researchers found that attacks exploiting flaws in protocol logic rose from 28% of flash loan losses in the first two years of the study to 55% in the most recent period, overtaking price oracle manipulation as the dominant technique.
GoKawiil's interpretation of the reporting above, not reported fact.
The shift suggests that as protocols have hardened their price-feed mechanisms, attackers have adapted by probing weaknesses in contract logic such as donation functions and reentrancy, which may require different auditing approaches than oracle fixes. Because just four attack types account for over 81% of losses, security teams could potentially concentrate resources on a narrow set of known exploit patterns, according to the study's framing of the data.
- 72 flash loan attacks caused $1.211 billion in losses from Feb 2020 to July 2024, per the study.
- Logic-based exploits grew from 28% to 55% of flash loan losses over the study period, overtaking oracle manipulation.
- Four attack types—price oracle, donate function, reentrancy, and one governance exploit—caused over 81% of total losses.
Source: techreport.com — Krishi Chowdhary, 2026-10-07
Published there as: “Flash loan attackers are ditching oracle manipulation for protocol logic exploits”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.