Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
ETH From 2020 to July 2024, lightning attacks caused losses in the decentralized finance sector of US$1.211 billion
According to the latest research published in the Financial Crime Journal, between February 2020 and July 2024, lightning attacks in the decentralized finance (DeFi) sector caused a total of 72 cases with a total of US$1.211 billion in losses.
The scale and impact of the lightning loan vulnerability
This research report, co-written by Professor Tim Hall of the University of Winchester and Remo Stiger, a former partner of Swiss risk intelligence firm SyntiFi, reviewed 254 successful attacks that resulted in a total of $6.568 billion in DeFi losses. Among them, events related to flash loans accounted for 18.44% of the total losses.
Professor Hall said that research has found a completely new nature of criminal acts in the field, with some cases involving amounts "often reaching tens of millions of dollars," highlighting the rapid evolution of digital financial threats. Professor Hall pointed out that forms of crime never seen before in the financial world have emerged, with certain attacks capable of sweeping away tens of millions of dollars in a single operation.
Small Dictionary: Lightning Loan -A type of loan that does not require collateral in DeFi and must be borrowed and repaid within a single blockchain transaction. This feature makes possible fast and complex operations, including arbitrage or in some cases offensive behavior.
Lightning Loan is a tool in DeFi that allows users to borrow assets from a liquidity pool without providing collateral, provided that the loan is repaid in the same blockchain transaction. Attackers can use lightning loans to gain large amounts of capital and execute complex attack strategies.
During the study period, more than 80% of lightning loan attack losses occurred on the Ethereum network. The report documented isolated incidents ranging from $80,000 to $197 million, with attacks of more than $10 million accounting for more than 88% of all lightning loan-related losses.
Tactical shifts and significant vulnerabilities
Researchers have identified 14 different types of lightning loan attacks, which can be roughly divided into price-feed manipulation and attacks that exploit flaws in protocol logic. Although logical exploit is rare, it results in a higher average loss. The share of losses attributed to logical vulnerabilities increased from 28% from February 2020 to January 2022 to 55% from February 2022 to July 2024.
Four attack methods accounted for more than 81% of the total losses: a price oracle attack, a donation function logic vulnerability, a re-entry attack, and a right-of-management attack that alone caused a loss of $181 million.
研究人员观察到，随着平台加强安全性，攻击者开始寻找新型漏洞。报告强调了攻击模式的成长与巩固阶段，反映了DeFi安全领域中这种“猫鼠游戏”的动态。
论文指出，平台在遭受重大损失后提高了安全性，但攻击者不断发现新的漏洞，推动了新一轮事件的发生。
重大攻击带来的人为与技术代价
一家经历重大闪电贷攻击的平台匿名向研究人员透露，被利用的漏洞此前已通过内部和外部审计，并在链上存在了一年多才被发现。
据该平台代表称，攻击者既包括“业余的个人研究者”，也包括有组织的团体，有时甚至得到国家背景的支持。他们表示，从区块链安全的角度来看，即使是专业攻击也“并不先进”。
研究还描述了此类事件如何给许多团队带来严重的内部损害。该代表报告称，即使部分资金后来被追回，项目团队也往往分崩离析或遭到毁灭性打击。
趋势、应对措施与持续风险
闪电贷损失仅在其中一个六个月内超过了所有借贷价值的0.5%，而在覆盖的年份里，闪电贷的使用量持续增长。作者将闪电贷攻击描述为严重且日益复杂，但并未将其视为对DeFi行业整体生存的威胁。
After the research period ended, decentralized exchange Bunni closed in October 2025 after losing $8.4 million in a lightning loan-based attack and saying the security costs of restarting were unsustainable.
Professor Hall emphasized the real-world impact of these findings, saying that their research has multiple application values in the cryptocurrency industry, regulators and law enforcement agencies.
