研究报告：2020至2024年间，闪电贷攻击从DeFi中抽走12亿美元

Lightning loan attacks cost DeFi platform $1.211 billion: Research reveals new financial crime threats

According to new research published in the Financial Crime Journal, between February 2020 and July 2024, lightning loan attacks extracted $1.211 billion from decentralized finance (DeFi) platforms. The research was conducted by Professor Tim Hall of the University of Winchester and Remo Stiger, a former partner at Swiss risk intelligence firm SyntiFi.

Attack Scale and Loss Distribution

Research found that of the 254 successful DeFi attacks that occurred during the same period, 72 involved Lightning Loans. These attacks caused a total of US$6.568 billion in losses, of which lightning attacks accounted for 18.44%.

Professor Hall said in a statement: "We are now witnessing unprecedented criminal behavior." He pointed out that certain attacks "can steal jaw-dropping amounts of money, often worth tens of millions of dollars."

Lightning loans allow users to lend assets from a liquidity pool without providing collateral, provided that the loan must be repaid within the same blockchain transaction. Attackers use this mechanism to obtain large amounts of money needed to perform the exploit.

Ethereum becomes the hardest hit area

Research results show that more than 80% of lightning loan attack losses occur on the Ethereum network. Losses caused by a single attack range from $80,000 to $197 million, with single theft of more than $10 million accounting for more than 88% of the total losses.

Researchers identified 14 types of lightning lending attacks, which are divided into two main categories: attacks that manipulate price feeds and attacks that exploit flaws in the underlying logic of the protocol. Although logical vulnerability attacks are less frequent, they cause higher economic losses on average.

Paper data shows that from February 2020 to January 2022, logical vulnerability attacks accounted for 28% of lightning loan attack losses; from February 2022 to July 2024, this proportion rose to 55%.

Main attack types and security warnings

Four attack types caused more than 81% of the damage: price oracle attack, donation function logic exploit, reentry attack, and a single governance attack that resulted in US$181 million in damage.

Attack activity shows alternating phases of growth and integration, which the authors believe suggests that the platform has improved security after being attacked, and attackers have turned to look for new vulnerabilities.

The study cited an anonymous interview with the head of a platform that suffered a major lightning attack. Representatives of the platform said that the exploit even passed "review by ourselves and multiple auditors" and remained undiscovered on the chain for more than a year. Hall pointed out that the attackers have since "provoked" the platform on social media, causing some victims to come into contact with the attackers, and described the devastating impact of financial losses on them.

The chief divided the attackers into two categories: "amateur individual researchers" and professional national or organized criminal groups (such as North Korean-backed hacker groups). From the perspective of blockchain security, the representative said that the methods of professional attackers are "not advanced," but their destructive power is huge.

In addition, the representative described the psychological blow caused by the attack to the team, pointing out that "even if funds are recovered, in most cases, the team will split or even collapse."

Industry Impact and Future Outlook

Research found that in just six months, losses exceeded 0.5% of the value borrowed through flash loans, and the use of flash loans continued to grow. The authors characterize these attacks as posing a significant, increasingly complex and unpredictable "non-survivable" threat to DeFi.

However, the practical challenges remain severe. Since the end of the research cycle, decentralized exchange Bunni was closed in October 2025 due to an $8.4 million vulnerability involving flash loans due to its inability to afford the cost of a secure restart.

Hall emphasized: "We are eager to see this as more than just academic research." He said: "Our analysis results have broad application value to the cryptocurrency industry, regulators and legal enforcement agencies."