What Is a Flash Loan Attack and Could It Drain Your Deposit?

02 November 2026

A flash loan attack is a type of exploit where a malicious actor borrows a large amount of cryptocurrency without collateral, manipulates a DeFi protocol's price or state within a single transaction, and repays the loan before the transaction ends - all in seconds. Yes, a flash loan attack can drain your deposit if the protocol you’re using is vulnerable, but the attack targets the protocol’s smart contracts, not your wallet directly.

How flash loans work

Flash loans are uncollateralized loans that exist only within one Ethereum (or compatible) transaction. The borrower must return the loan plus a fee in the same block, or the entire transaction reverses as if it never happened. This mechanism lets anyone borrow huge sums - millions of dollars - for a few seconds, provided they write a smart contract that executes the whole sequence without failing.

Valid uses include arbitrage between decentralized exchanges or refinancing positions in lending protocols. Attackers, however, use the same tool to exploit weaknesses.

Anatomy of a Flash Loan Attack

The attack typically follows this structure:

1. Borrow funds via flash loan. The attacker takes a large amount of a token (often a stablecoin) from a lending protocol that offers flash loans, like Aave or dYdX.
2. Manipulate a price. They trade the borrowed tokens on a decentralized exchange (DEX) with low liquidity, artificially inflating or crashing a token’s price. This is the same principle as oracle manipulation, but the flash loan provides the capital to do it at scale.
3. Exploit the distorted price. With the skewed price, the attacker executes a trade, deposit, withdrawal, or liquidation in a target protocol. For example, they might deposit collateral that suddenly looks overvalued, borrow more than they should, or trigger a liquidation that gives them more than they paid.
4. Repay the flash loan. The attacker uses profits from step 3 to repay the borrowed funds plus a small fee. Any remaining profit is theirs.
5. Transaction succeeds or fails. If the repayment happens in the same block, the attack works. If anything goes wrong, the whole transaction reverts, and the attacker loses only gas fees.

Could it drain your deposit?

The short answer: a flash loan attack can drain your deposit only if the protocol you deposited into has a vulnerability that allows the attack to extract value from its pools.

Here’s what that means:

• If you deposited into a lending protocol that gets exploited via a flash loan, the attacker can drain the protocol’s reserves, including the portion belonging to your account. This happened to Cream Finance in 2021 and to several other lending platforms.
• If you provided liquidity to a DEX pool that gets price-manipulated, the attacker can swap tokens at the manipulated rate, taking value from the pool. Your LP tokens lose value as a result.
• If you use a yield aggregator or vault that automates strategies, those strategies might be susceptible. For example, a vault that rebalances positions using a DEX could be tricked by flash loan price manipulation.

However, a flash loan attack cannot drain your wallet directly unless you have approved a vulnerable contract to spend your tokens. The attack happens inside the protocol’s smart contracts - not on your personal address.

How to assess your risk

You cannot stop a flash loan attack from happening, but you can reduce the chance of your deposits being hit:

• Use established, heavily audited protocols that have survived multiple market cycles. Even audits are not guarantees, but older, battle-tested protocols like Aave, Compound, and Uniswap have more eyes on their code and have fixed known vulnerabilities.
• Check if the protocol has a "circuit breaker" or pause mechanism. Many modern DeFi protocols include functions that allow the team to pause deposits, withdrawals, or trading if an exploit is detected. This gives time to patch the bug rather than letting attackers drain everything.
• Avoid protocols with low total value locked (TVL). Small pools are easier to manipulate because an attacker needs less capital to move the price. Flash loan attacks are more common on smaller or newer protocols.
• Look for borrowed asset controls. Some protocols limit how much of a single asset can be borrowed via flash loans, making large-scale manipulation harder.
• Understand the protocol’s price source. If it uses a decentralized oracle like Chainlink rather than a single DEX price, flash loan attacks are much harder because the oracle aggregates multiple sources and resists instant manipulation.

What Happens to Your Funds After an Attack

If a flash loan attack succeeds and drains a protocol, the outcome depends on the protocol’s design:

• Loss of funds. In most cases, your deposits vanish. The attacker takes the stolen assets, and the protocol becomes insolvent.
• Partial recovery. Some protocols have insurance funds or token reserves that compensate users partially. Others issue "IOUs" (tokens that represent a claim on future protocol revenue) that may trade at a fraction of your original value.
• No compensation. Without a recovery mechanism, you lose everything you deposited.

Key Distinction

A flash loan attack exploits smart contract logic errors, not your personal security. The attacker does not steal your private keys or trick you into signing a malicious transaction. They borrow money from the system, use the system against itself, and return the borrowed money - all within a second. Your deposit is vulnerable only because it sits inside the protocol that has the bug.

To protect yourself, focus on the protocol’s security record, not on protecting your wallet from direct flash loan attacks. The risk is real, but it is a protocol risk, not a personal one.

Back to defi yield