Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
ETH DeFi protocol code vulnerabilities become the main cause of lightning loan losses: Research report from February 2022 to July 2024
According to a study published in the Financial Crime Journal, between February 2022 and July 2024, attacks using decentralized finance (DeFi) protocol code errors resulted in 55% of lightning loan losses. In comparison, the proportion was only 28% in the previous two years, a significant increase that puts such attacks ahead of price data manipulation attacks.
Research Background and Methods
The study was co-authored by Tim Hall, professor of the Department of Police and Criminology at the University of Winchester, and Remo Stieger, former partner of SyntiFi Risk Intelligence. Researchers recorded 72 flash loan attacks from February 2020 to July 2024, with a total loss of US$1.211 billion.
Four major types of attacks caused more than 81% of losses
Lightning loans allow borrowers to borrow unsecured cryptocurrency before the same blockchain transaction ends and must repay it within this period. Although this behavior is not illegal in itself, it provides attackers with capital to exploit without having to bear their own risks.
Among the 14 attack types identified in the study, they are mainly divided into two categories: one is to exploit price data trusted by the protocol, and the other is to abuse flaws in the protocol logic. Among them, logical attacks have fewer targets, but cause greater losses on average.
Specifically, the price oracle attack, donation function logic exploit, re-entry attack, and a separate $181 million governance attack together accounted for more than 81% of the total loss.
Attack patterns and defense evolution
The authors observed that the wave of attacks showed cyclical ups and downs and gradually subsided after each round of attacks. They attribute this pattern to the platform stepping up defenses after being attacked, and attackers subsequently discover new vulnerabilities.
The Ethereum network suffered most of the losses
Attacks with losses of more than $10 million (ranging from $80,000 to $197 million) accounted for more than 88% of the total losses, with the Ethereum network alone responsible for more than 80% of the losses.
During the entire statistical period, flash loan attacks accounted for 18.44% of the total losses of US$6.568 billion caused by 254 successful DeFi attacks. SyntiFi's on-chain engine aggregated these data by analyzing 20.63 billion transactions on Ethereum, Base, Optimism, Arbitrum, BNB Chain, Avalanche and Polygon.
Threat Assessment: Severe and increasingly complex, but non-existent crises
Although lending continues to climb, losses exceeded 0.5% of total borrowing through flash loans in only a six-month period throughout the statistical period. As a result, the authors believe that the threat is "serious and increasingly complex" but "not an existential crisis."
"We are now seeing criminal acts unseen before, capable of stealing shocking amounts of money, often up to tens of millions of dollars," Hall said in a university statement.
Hall also mentioned a case in which an attacker ridiculed the victim platform on social media, a tactic he said caused some victims to interact with the attacker and described the devastating impact of financial losses on them.
Recent Typical Cases
According to Cryptopolitan, in March 2026, Venus Protocol suffered losses of more than US$3.7 million due to exploiting loopholes in low-liquid THENNA collateral. In April of the same year, Scallop, a lending platform based on the Sui Network, lost $142,000 when attackers exploited uninitialized variables in flash loans and outdated reward contracts.
