AMLConsensus · course
Programme · Lesson 7.7
Section 7 · Lesson 7.7

Flash-loan attacks and protocol manipulation

A flash loan is a unique invention of DeFi, impossible in ordinary finance: you can borrow millions of dollars with no collateral, provided you return them within the same transaction. The instrument was devised for honest arbitrage trading, but it has become the favorite "lever" of hackers: with it, protocols are drained of tens and hundreds of millions. For an AML analyst it is important to understand the mechanics — because on the graph such an attack looks nothing like classic laundering, and the two must not be confused.

What a flash loan is

An ordinary loan requires collateral and time. A flash loan works on the property of transaction atomicity in the blockchain: everything that happens within a single transaction is either executed in full or not executed at all. The protocol lends you any amount you like on one condition — return the sum (plus a fee) before the end of that same transaction. If the debt is not repaid by the end of the transaction, the whole transaction is rolled back as if it never happened, and the lender risks nothing.

The key to understanding. A flash loan is not "money in your account for a week." It is a loan a fraction of a second long, living inside a single operation. Between "borrowed" and "returned" a whole sequence of actions fits — and it is into this gap that the attack is inserted.

1. Borrow $50M
2. Manipulate
3. Drain the protocol
4. Return $50M
5. Take the profit

All in one transaction. The borrowed capital is a temporary lever; the real loot is step 3.

The mechanics of the attack: oracle price manipulation

The most common type of flash-loan attack is price-oracle manipulation. Many DeFi protocols (lending, derivatives) learn the price of an asset not from an independent source but from a liquidity pool on a decentralized exchange. If the pool is shallow, a huge flash loan can temporarily "push" the price in that pool — and the protocol will believe the false price.

  1. The loan. The hacker takes a flash loan of, say, $50M in a stablecoin.
  2. Pushing the price. They dump this money into a shallow pool of token X, sharply pumping (or crashing) its price in that specific pool.
  3. Deceiving the victim protocol. The lending protocol looks at the price from this pool, sees an inflated value for the hacker's collateral, and lets them borrow/withdraw far more than they should.
  4. Extraction. The hacker withdraws real funds from the protocol above the norm — this is the theft.
  5. Repaying the loan. They return the $50M to the lender, restoring the price in the pool. All in one transaction.
  6. Profit. The difference between what was drained and what was returned stays with the hacker — sometimes tens of millions.

There are other variations too: manipulating the reward-calculation mechanism, reentrancy bugs, substituting the rate on token mint/burn. But the general principle is one: a flash loan provides temporary capital in order to deceive the protocol's logic, not in order to "borrow and never repay."

How it looks on the transaction graph

For an AML analyst, the most important thing is to learn to recognize the attack's footprint. It is very characteristic and sharply different from laundering money flows.

Attack (1 tx)
flash loan + manipulation
Loot
the hacker's net profit
Laundering
bridge → mixer → exchanges

How the attack differs from laundering

This is the key point of the lesson. A beginning analyst may see "$50M passed through the address" and log it as laundering — and be wrong.

A practical conclusion for tracing. Having seen a flash-loan attack, do not chase the "body" of the loan — it is fictitious and returned to its place. Determine the net gain on the attacker's address after the transaction — this is the sum being laundered. Then trace that: where it went, through which bridge, into which mixer. Exposure from such an address carries the theft/hack category at maximum weight.

Why this is in the typologies section. A flash loan is not about laundering in the pure sense but about the source of the dirt. By understanding where the funds came from, you correctly classify the risk: an address that received even a share of such loot carries "stolen" exposure, and any KYC exchange will act on it at deposit.

The main takeaways

This material is for educational purposes.