Flash Loans in DeFi: How They Work, 5 Real Uses and the Dangerous Risks Every User Should Know

Flash loans sound impossible the first time you hear about them. Imagine walking into a bank, borrowing $50 million with no credit check and no collateral, using it, and paying it all back before you leave the counter. In traditional finance, that would never happen. In decentralized finance, it happens thousands of times a day.

The trick is that a flash loan lives inside a single blockchain transaction. The money is borrowed, used, and returned in one atomic step. If the borrower cannot repay, the entire transaction is cancelled as if it never happened, so the lender never takes on real credit risk.

That simple idea has made DeFi flash loans one of the most powerful tools in crypto. Traders use them for arbitrage, users rely on them to refinance or rescue positions, and developers build them into automated strategies. But the same feature that makes them useful, instant access to huge amounts of capital, has also made them a favorite tool in some of the largest DeFi exploits ever recorded.

This guide explains how flash loans work in plain language, with a step-by-step example and a simple diagram. You will also see where flash loans are available, five legitimate ways people use them, how flash loan attacks happen, the biggest incidents so far, and how protocols and everyday users can protect themselves. No coding background is required.

What Are Flash Loans?

Flash loans are uncollateralized loans that must be borrowed and repaid within the same blockchain transaction. You do not need to put up any collateral or pass a credit check. The only condition is that the full amount, plus a small fee, is returned before the transaction ends.

That condition is enforced by code. A lending pool’s smart contract sends the funds, lets the borrower’s contract run whatever instructions it wants, and then checks its own balance at the end. If the money is not back, the contract cancels everything.

Why Flash Loans Are Possible: Atomic Transactions

The key concept is the atomic transaction. On blockchains like Ethereum, a transaction either completes fully or fails completely. There is no halfway state. If any step in the chain of instructions fails, every step before it is reversed too.

That is what makes uncollateralized loans safe for the lender. Either the loan is repaid in the same transaction, or the loan effectively never happened. The only cost to a failed borrower is the gas fee they spent trying.

How Flash Loans Work, Step by Step

Here is a simple example of a flash loan used for arbitrage, where the same token trades at different prices on two exchanges.

Step 1: Borrow From a Lending Pool

The borrower’s smart contract requests 1 million USDC from a protocol that offers flash loans. The pool sends the funds immediately.

Step 2: Use the Funds

The contract buys a token on exchange A, where it is slightly cheaper.

Step 3: Complete the Strategy

The contract sells the same token on exchange B, where the price is slightly higher, and ends up with more USDC than it started with.

Step 4: Repay the Loan Plus a Fee

The contract sends back the 1 million USDC plus the protocol’s fee. The lending pool checks that it has been repaid in full.

Step 5: Success or Revert

• If repaid: the transaction completes, and the borrower keeps whatever profit is left after fees and gas.
• If not repaid: the entire transaction reverts. The trades are undone, the pool keeps its money, and the borrower loses only the gas fee.

Who Can Use Flash Loans?

In principle, anyone. In practice, using flash loans usually requires writing or deploying a smart contract, because everything has to happen automatically within a single transaction. A growing number of tools and DeFi apps now use flash loans behind the scenes, so ordinary users often benefit from them without realizing it.

Where Can You Get Flash Loans?

Several major DeFi protocols offer flash loans or something very similar. Fees and features change through governance, so always check the latest documentation.

• Aave: the protocol that made flash loans popular. Borrowers pay a small fee, historically around 0.05% of the amount, which goes to liquidity providers and the protocol.
• Balancer: its vault design lets users borrow tokens held across its pools, and it has been known for offering flash loans with no protocol fee.
• Uniswap flash swaps: instead of a classic loan, Uniswap lets you receive tokens from a pool before paying for them, as long as you pay or return them by the end of the transaction. The normal swap fee applies.
• Morpho: its lending markets also support flash loans, which developers use for refinancing and leverage tools.

These are not the only options. Many lending protocols and DEXs have added flash loan or flash swap features, and aggregators can route a flash loan to the cheapest source automatically.

5 Legitimate Uses of DeFi Flash Loans

Flash loans get a lot of bad press, but most flash loan activity is ordinary financial plumbing. Here are five common, legitimate uses.

1. Arbitrage

The classic use. When the same token trades at different prices on two exchanges, a trader can borrow, buy on the cheaper venue, sell on the more expensive one, and repay, all in one transaction. This keeps prices aligned across DeFi, which benefits everyone. In practice, arbitrage opportunities are tiny and highly competitive, so most are captured by automated bots.

2. Collateral Swaps

Say you have borrowed stablecoins against ETH on a lending protocol, and you want to switch your collateral to wrapped bitcoin without closing the loan first. A collateral swap uses a flash loan to repay your debt temporarily, withdraw the ETH, swap it for the new collateral, deposit it, reborrow, and repay the flash loan. You end up with the same debt backed by different collateral in a single step.

3. Debt Refinancing

If another protocol offers a lower borrowing rate, a flash loan can move your whole position at once. It repays your old loan, releases your collateral, deposits it on the new platform, opens a cheaper loan, and repays the flash loan. Without flash loans, you would need enough spare capital to repay the first loan yourself.

4. Liquidations and Self-Liquidation

Lending protocols rely on liquidators to close risky loans before they go bad. Flash loans let liquidators do this without holding large amounts of capital, which keeps lending markets healthy. Borrowers can also use flash loans to close their own position before it is liquidated, often avoiding the liquidation penalty.

5. Building and Unwinding Leverage

Some DeFi apps use flash loans to open a leveraged position in one transaction instead of repeating the deposit, borrow, and swap cycle many times. They can also unwind leverage the same way. This saves gas and reduces the risk of prices moving halfway through.

Flash Loans Are Mostly Infrastructure

For everyday users, the main takeaway is that flash loans often work quietly in the background. If you have used a “one-click” leverage, refinancing, or collateral swap feature in a DeFi app, there is a good chance a flash loan powered it.

Flash Loan Risks: How Flash Loan Attacks Happen

Here is the most important point about a flash loan attack: the flash loan is almost never the actual bug. It is an amplifier. The real weakness is a flaw somewhere in a protocol, such as a price feed that can be pushed around or code that behaves differently at large scale. A flash loan simply gives an attacker enough temporary capital to make exploiting that flaw worth it.

Without flash loans, an attacker would need tens or hundreds of millions of dollars of their own. With them, they need only the skill to find a weakness and the gas to run one transaction.

How Big Is the Problem?

A peer-reviewed study by researchers at the University of Winchester reviewed 254 successful DeFi attacks between 2020 and mid-2024. It found that 72 were flash loan attacks, costing about $1.21 billion, or 18.44% of all DeFi attack losses in that period. The authors described flash loan attacks as significant but not existential, noting that losses rarely exceeded 0.5% of the value borrowed through flash loans.

The threat has not gone away. Blockchain intelligence firm TRM Labs counted 32 price manipulation attacks on DeFi lending protocols in 2026 through early September, up from 12 in all of 2025, with many of them using flash loans to move thinly traded token prices.

Type 1: Price Oracle Manipulation

Many DeFi protocols need to know the price of assets, for example to decide how much someone can borrow. They get this from a price oracle. If a protocol reads its price from a single, thinly traded pool on a decentralized exchange, a very large trade can move that price sharply for a moment.

A flash loan provides the capital for that trade. The protocol briefly sees a wrong price, values collateral incorrectly, and lets the attacker borrow or withdraw more than they should. Then the price is pushed back, the loan is repaid, and the protocol is left with the loss.

Type 2: Logic Exploits

These target mistakes in how a protocol’s code handles certain actions, such as rounding errors, unusual deposit or “donate” functions, or accounting that breaks when numbers get very large. According to the same study, logic exploits grew from 28% of flash loan losses in the early period to 55% between 2022 and 2024, as oracle defenses improved and attackers moved on to code flaws.

Type 3: Reentrancy Attacks

A reentrancy bug lets an attacker’s contract call back into a protocol before the protocol finishes updating its records, sometimes allowing funds to be withdrawn more than once. Flash loans can make the damage much larger by supplying the capital to repeat the trick at scale.

Type 4: Governance Attacks

Some protocols let token holders vote on changes using tokens they hold at the moment of voting. If a protocol allows voting and execution in the same transaction, a flash loan can briefly supply enough tokens to pass a malicious proposal. The study identified a single governance attack that cost about $181 million, widely recognized as the Beanstalk exploit of 2022.

Major Flash Loan Attacks in DeFi History

Other Flash Loan Risks to Know

Attacks are the headline risk, but there are others, especially for people building or using flash loan tools.

• Failed transactions still cost gas. If your transaction reverts, you lose the network fee, which can be large on busy networks.
• Smart contract bugs in your own code. A mistake in a custom flash loan contract can leave funds stuck or exposed.
• Competition and MEV. Arbitrage opportunities are fiercely contested by bots and block builders, and transactions can be front-run.
• Protocol and integration risk. Apps that use flash loans in the background depend on every protocol they touch working correctly.
• Contagion for ordinary users. Even if you never take a flash loan, funds you deposit into a vulnerable protocol can be drained by someone who does.

How DeFi Protocols Defend Against Flash Loan Attacks

Because flash loans are open to anyone, protocols cannot simply block them. Instead, they design systems that stay safe even when someone has enormous temporary capital.

Use Robust Price Oracles

• Decentralized oracle networks such as Chainlink aggregate prices from many sources, which makes them much harder to move with one trade.
• Time-weighted average prices (TWAP) smooth prices over minutes or hours, so a single-transaction spike has little effect.
• Multiple independent sources with sanity checks catch prices that move too far, too fast.
• Avoiding thin pools as price sources, especially for small-cap tokens used as collateral.

Write and Test Code Carefully

• Independent audits from multiple security firms
• Formal verification for critical math and accounting logic
• Fuzz testing and invariant testing that simulate extreme inputs, including flash-loan-sized amounts
• Reentrancy guards and the “checks-effects-interactions” pattern to update balances before sending funds

Harden Governance

• Measure voting power using snapshots taken before a proposal starts, so borrowed tokens cannot vote.
• Add time locks between a vote passing and the change taking effect, giving the community time to react.
• Require proposals to pass through several stages rather than one transaction.

Limit the Blast Radius

• Borrow and supply caps for riskier assets
• Rate limits and circuit breakers that pause markets when something unusual happens
• Isolated markets so a problem with one asset does not drain everything
• Real-time monitoring that flags suspicious transactions
• Bug bounty programs that reward researchers for reporting flaws before attackers find them

The Ethereum.org smart contract security guide is a useful starting point for developers who want to understand these defenses in more depth.

How Everyday Users Can Protect Themselves

You do not need to understand smart contract code to lower your exposure to flash loan risks. A few habits go a long way.

1. Favor established protocols with long track records, multiple audits, and active bug bounties.
2. Check how prices are sourced. Protocols that use decentralized oracles and TWAPs are generally safer than those reading prices from a single pool.
3. Be careful with small-cap collateral. Lending markets that accept thinly traded tokens are the most common targets for price manipulation.
4. Watch for unusually high yields. Very high returns can signal risky collateral or immature code.
5. Diversify across protocols so one exploit does not wipe out your holdings.
6. Follow official channels and security firms for incident alerts, and act quickly if a protocol you use is paused or exploited.
7. Never interact with “recovery” or “refund” links shared after a hack. Scammers often target victims of real exploits.

Should You Use Flash Loans Yourself?

For most people, the honest answer is no, at least not directly. Building a profitable flash loan strategy requires programming skills, deep knowledge of DeFi, and the ability to compete with professional bots. The safer way to benefit is through trusted apps that use DeFi flash loans behind the scenes for collateral swaps, refinancing, or one-click leverage, and even then, only with money you can afford to lose.

FAQs About Flash Loans

Are flash loans legal?

Flash loans themselves are a standard feature of many DeFi protocols and are widely used for arbitrage, refinancing, and liquidations. Using them to exploit a protocol, however, can lead to civil and criminal consequences in many countries, and some attackers have faced prosecution.

Can anyone take out flash loans?

Technically, yes. There is no credit check or collateral. In practice, you usually need to write or use a smart contract, because the borrowing, using, and repaying all have to happen automatically in one transaction.

Why don’t lenders lose money on flash loans?

Because the loan and repayment happen in the same atomic transaction. If the borrower does not repay in full, the blockchain reverses the entire transaction, so the lender’s funds never actually leave.

How much do flash loans cost?

Costs vary by protocol. Aave has historically charged a small percentage fee, some protocols charge no flash loan fee, and Uniswap flash swaps pay the normal swap fee. On top of that, the borrower pays the network gas fee.

Are flash loans the cause of DeFi hacks?

Not directly. Flash loans provide temporary capital that makes attacks bigger, but the root cause is usually a flaw in a protocol, such as a weak price oracle, a logic bug, or unsafe governance. Fixing those weaknesses is what stops flash loan attacks.

Can flash loans affect me if I never use them?

Yes, indirectly. If you deposit funds into a protocol that has a vulnerability, an attacker using flash loans could drain it. Choosing well-audited protocols with strong oracle design and spreading your deposits reduces that risk.

Conclusion

Flash loans are one of the most original ideas in decentralized finance, letting anyone borrow huge sums with no collateral because the loan must be repaid within a single atomic transaction or the whole thing is reversed. Offered by protocols like Aave, Balancer, Uniswap, and Morpho, they power everyday tasks such as arbitrage, collateral swaps, debt refinancing, liquidations, and one-click leverage. The same instant access to capital also makes them a powerful amplifier for attackers who find weak price oracles, logic bugs, reentrancy flaws, or unsafe governance, with flash loan attacks costing more than $1.2 billion in their first four years and price manipulation attacks rising again in 2026. For protocols, the answer is robust oracles, careful code, hardened governance, and limits on damage; for everyday users, it is sticking with well-audited platforms, being wary of thinly traded collateral and unusually high yields, and diversifying, so you can benefit from what flash loans make possible without becoming collateral damage.