I spent three weeks tracing flash loan transactions through block explorers — how did a feature that lets anyone borrow millions of dollars with zero collateral, repaying it in the same thirteen-second block, become the most consequential and most misunderstood primitive in decentralized finance?
January 2020: Aave Ships a Feature Nobody Fully Understood
I keep coming back to this detail: when Aave launched flash loans on Ethereum mainnet in early 2020, the feature got almost no attention. The DeFi world was small. Total value locked across all protocols was a rounding error compared to what a single centralized exchange moves today — Binance alone now processes around $18,500 million in daily volume across 1,850 trading pairs. The entire DeFi sector in January 2020 would not have filled a slow afternoon on Binance's spot order book.
The mechanic is this. A flash loan lets you borrow any amount of an asset from a lending pool, use it however you want within that same Ethereum transaction, and repay it — plus a protocol fee — before the transaction finalizes. If the repayment does not happen, the entire transaction reverts. Every step unwinds. The blockchain state resets to what it was before you tried. The lender loses nothing. You lose nothing except the gas fee for a failed transaction.
No collateral. No credit check. No relationship with the lender. The risk model is not "we trust you to repay." The risk model is "the smart contract physically cannot settle unless you repay." Enforcement by code, not by contract law, not by reputation, not by a compliance department.
I want to be precise about what makes this strange. In traditional finance — or on centralized exchanges like Bybit or OKX, where borrowing requires either collateral on deposit or a margin agreement backed by your account balance — the concept of an unsecured loan to a stranger is incoherent. Flash loans need none of that. The constraint is temporal, not financial. You get the money and you return it in the same atomic operation. The concept of default cannot exist because the concept of time between borrowing and repaying does not exist.
February 2020: Two Attacks, Four Days, Zero Collateral
On February 14, 2020, someone used a flash loan to extract funds from the bZx protocol. Four days later, on February 18, it happened again. Different method, same category, same target. Both attacks were single Ethereum transactions. Both are permanently recorded on-chain — timestamped, traced, and readable by anyone who opens Etherscan today and searches for the bZx events. Every internal call, every token transfer, every contract interaction is public. Not behind a paywall, not locked in a compliance filing, not subject to a FOIA request. Just there.
Here is what the first one did. The attacker borrowed ETH from Aave via flash loan. They deposited part of it into Compound as collateral and borrowed a different asset against it. They used the remaining ETH to push prices on Uniswap — buying aggressively enough to move the spot rate. With the price distorted, they triggered a margin trade on bZx that executed at the manipulated price. bZx's system, trusting its price feed, processed the trade at a loss to the protocol and a gain to the attacker. Positions unwound, flash loan repaid, profit extracted. One transaction. One block.
The community debated for weeks whether this was a "hack" or just sophisticated arbitrage. The smart contracts did exactly what they were programmed to do. Nobody's private key was stolen. No system was breached in the traditional sense. The attacker composed existing DeFi primitives — lending, borrowing, swapping, margin trading — in a sequence the designers had not stress-tested.
— and this is the part every flash loan explainer gets wrong. They describe the mechanic and stop. Borrow, use, repay, atomic, reverts if unpaid. Fine. But the mechanic is not the story. The story is what becomes possible when capital has no cost and execution carries no risk of loss. The bZx attacker did not invent a new vulnerability. They removed the capital barrier to exploiting one that was already sitting there, documented in the contract code, waiting.
October 2020: The Harvest
Seven months later, the pattern repeated with a different face. Harvest Finance — a yield aggregation protocol holding significant user deposits at the time — was hit by a series of flash loan transactions on October 26, 2020.
The mechanic was different but the category was identical to bZx. The attacker flash-loaned a large sum and used it to make heavy swaps in a Curve Finance pool, temporarily moving the pool's spot price. Harvest Finance relied on that pool's instantaneous price as its oracle — the ground truth it used to calculate the value of deposits and withdrawals. With the oracle distorted, the attacker deposited into Harvest at the manipulated valuation, then reversed the Curve swap to restore the original price, making their deposit immediately worth more than what was paid for it. Withdraw the profit. Repeat the cycle in rapid transactions.
What killed Harvest was not flash loans. What killed Harvest was using a manipulable spot price as an accounting input. The flash loan made it free to demonstrate the design flaw. A well-capitalized trader with their own funds could have executed the same strategy — they would simply have needed real money and real appetite for the risk of the price not reverting as expected.
I spent time after this going through DeFi protocol documentation, checking how different projects handled price oracle design. The split was obvious: protocols using time-weighted average prices or Chainlink's decentralized oracle network were largely insulated from this attack shape. Protocols relying on instantaneous AMM spot prices were exposed. The diagnostic was straightforward. The fix was known and documented. Yet protocol after protocol had shipped with the vulnerable pattern, because in the race to launch and capture deposits, thorough oracle architecture was treated as a later problem. Flash loans made it an immediate one.
April 2022: Someone Buys a Vote
This one changed how I think about on-chain governance entirely. On April 17, 2022, Beanstalk Farms — a stablecoin protocol on Ethereum — was drained through a mechanism that had nothing to do with price manipulation or oracle design.
The attacker used a flash loan to borrow enough of Beanstalk's governance token to gain majority voting power. With that borrowed stake, they proposed and immediately executed a governance action — one that directed the protocol's treasury to an address the attacker controlled. Funds transferred out. Flash loan repaid. Single block.
Consider what happened. The attacker did not buy permanent ownership of anything. They did not accumulate tokens quietly over weeks. They rented governance influence for the duration of one Ethereum block, passed a resolution, extracted the treasury, and returned the borrowed tokens. The governance system treated temporarily borrowed tokens identically to tokens held for months. No lockup requirement. No time delay between proposal submission and execution. No minimum holding period for voting eligibility.
— I want to take a detour here, because Beanstalk says something uncomfortable about on-chain governance that extends well beyond flash loans. If voting power can be rented for thirteen seconds, then what the protocol calls "decentralized governance" is a price function, not a political process. Beanstalk's governance was not compromised by an outside attacker who found a bug. It was used exactly as designed, by someone who noticed that the design equated capital with legitimacy and that capital could be borrowed for free.
After Beanstalk, several protocols implemented vote-locking — requiring governance tokens to be locked for a minimum period before they carry voting weight. The fix is not theoretical. It exists. Whether it has been universally adopted across every protocol that still runs time-insensitive governance is a question I will leave open, because the answer is not encouraging.
March 2025: The Part Nobody Writes About
By now, flash loans are infrastructure. Unremarkable infrastructure. The exploit narratives dominate because they are dramatic, but the bulk of flash loan usage in 2025 is operational plumbing that generates no headlines.
Self-liquidation is the clearest example. You hold a collateralized debt position — ETH deposited, stablecoins borrowed against it. The market drops and your position is approaching liquidation. Without a flash loan, you scramble to source funds from somewhere else to partially repay the debt and save the position. With a flash loan, you borrow stablecoins, repay your debt, free your ETH collateral, sell enough ETH to cover the flash loan repayment, and redeposit the rest. One transaction. No external capital. No liquidation penalty. Collateral swaps work the same way — switch your backing asset without closing the position. Debt refinancing — move a loan from one protocol to another in a single atomic step.
The irony runs deep. Centralized exchanges have spent years building proof-of-reserves frameworks to demonstrate they actually hold the customer funds they claim — Binance's most recent verification dated March 2025, Bybit's on March 12 of the same month, OKX also verified that month. CER security scores reflect this effort: Binance at 9.4, OKX at 9.3, Bybit at 9.1. All of that work exists because centralized custody is opaque by default and transparency requires active, expensive auditing. DeFi lending protocols never faced that problem. Their reserves are the contract state, visible to anyone who queries the chain. Flash loans exist precisely because the capital is sitting there, verifiable in real time, and repayment is guaranteed by execution logic rather than attestation reports.
What It All Means
The math tells the story that the headlines do not. Suppose you spot a price discrepancy between two centralized exchanges and want to capture it through arbitrage. On Binance, the taker fee is 0.1%. On OKX, the maker fee is 0.08%. A million-dollar buy on Binance costs $1,000 in fees. Selling that million dollars' worth on OKX as a maker costs $800. Round trip fee burden: $1,800. That means the price discrepancy between the two exchanges must exceed 0.18% just to break even on trading fees — and that calculation ignores withdrawal processing times, network transfer costs, and the capital itself. You need a million dollars deposited on Binance. You need an equivalent position or inventory on OKX to sell into the bid. Call it two million in committed capital across two custodians to capture a spread that might exist for seconds. A flash loan executes the equivalent on-chain — DEX to DEX — for zero upfront capital. The trade either profits or it atomically reverts. No capital committed, no counterparty risk, no withdrawal queue. The asymmetry between $2,000,000 committed and $1,800 in fees versus $0 committed and a gas fee is the entire point of flash loans. It is also the part that most explainers skip in favor of retelling the exploit stories.
What I found after tracing these events through five years of on-chain records is simpler than the narrative landscape suggests. Flash loans did not create new vulnerabilities. Every protocol drained by a flash loan had a pre-existing flaw — a manipulable oracle, an unprotected governance function, a price calculation that trusted instantaneous spot data from a single source. Flash loans are a stress test that runs for free. They compress the question "could a sufficiently capitalized attacker exploit this design?" into a binary answer delivered in one block. If the answer is yes, the flash loan surfaces it. If the answer is no, the transaction reverts and nothing happens.
I would revise this assessment — that flash loans are net-positive for the security of the DeFi ecosystem — under one specific condition: if someone demonstrated a category of exploit that is exclusively possible through flash loans and could not, under any circumstance, be replicated by a funded attacker with patience and capital. In five years of tracing these transactions, I have not encountered that case. Every flash loan exploit I have examined is a well-funded-attacker exploit with the capital barrier removed. The Beanstalk governance attack could have been executed by someone who simply bought enough tokens. The Harvest Finance drain could have been run by a whale with deep pockets and a tolerance for execution risk. The bZx margin manipulation was a sequence of existing DeFi operations that anyone with enough ETH could have composed manually. Until someone shows me the counterexample — the exploit that truly could not exist without flash loans — the argument holds. Flash loans do not create risk. They surface it. And the protocols that died from flash loan attacks were carrying the vulnerability long before the flash loan found it.