Section 7 · Lesson 7.7
Flash-loan attacks and protocol manipulation
A flash loan is a unique invention of DeFi, impossible in ordinary finance: you can borrow millions of dollars with no collateral, provided you return them within the same transaction. The instrument was devised for honest arbitrage trading, but it has become the favorite "lever" of hackers: with it, protocols are drained of tens and hundreds of millions. For an AML analyst it is important to understand the mechanics — because on the graph such an attack looks nothing like classic laundering, and the two must not be confused.
What a flash loan is
An ordinary loan requires collateral and time. A flash loan works on the property of transaction atomicity in the blockchain: everything that happens within a single transaction is either executed in full or not executed at all. The protocol lends you any amount you like on one condition — return the sum (plus a fee) before the end of that same transaction. If the debt is not repaid by the end of the transaction, the whole transaction is rolled back as if it never happened, and the lender risks nothing.
The key to understanding. A flash loan is not "money in your account for a week." It is a loan a fraction of a second long, living inside a single operation. Between "borrowed" and "returned" a whole sequence of actions fits — and it is into this gap that the attack is inserted.
1. Borrow $50M
→
2. Manipulate
→
3. Drain the protocol
→
4. Return $50M
→
5. Take the profit
All in one transaction. The borrowed capital is a temporary lever; the real loot is step 3.
The mechanics of the attack: oracle price manipulation
The most common type of flash-loan attack is price-oracle manipulation. Many DeFi protocols (lending, derivatives) learn the price of an asset not from an independent source but from a liquidity pool on a decentralized exchange. If the pool is shallow, a huge flash loan can temporarily "push" the price in that pool — and the protocol will believe the false price.
- The loan. The hacker takes a flash loan of, say, $50M in a stablecoin.
- Pushing the price. They dump this money into a shallow pool of token X, sharply pumping (or crashing) its price in that specific pool.
- Deceiving the victim protocol. The lending protocol looks at the price from this pool, sees an inflated value for the hacker's collateral, and lets them borrow/withdraw far more than they should.
- Extraction. The hacker withdraws real funds from the protocol above the norm — this is the theft.
- Repaying the loan. They return the $50M to the lender, restoring the price in the pool. All in one transaction.
- Profit. The difference between what was drained and what was returned stays with the hacker — sometimes tens of millions.
There are other variations too: manipulating the reward-calculation mechanism, reentrancy bugs, substituting the rate on token mint/burn. But the general principle is one: a flash loan provides temporary capital in order to deceive the protocol's logic, not in order to "borrow and never repay."
How it looks on the transaction graph
For an AML analyst, the most important thing is to learn to recognize the attack's footprint. It is very characteristic and sharply different from laundering money flows.
- One gigantic transactionDozens of internal calls within a single transaction: loan, swaps, withdrawal, repayment — all in one hash. Not a chain of transfers over time, but an "explosion" in one block.
- Loan = repaymentThe loan amount comes from the lender protocol and returns to it in the same transaction. This is "idle" capital — it is not the loot.
- An anomalous protocol imbalanceMore flows out of the victim pool/protocol than it should; reserves drop sharply in a single block.
- The real loot is the clean remainderAfter the loan is repaid, a profit remains on the attacker's address. It is with this that the actual laundering begins — usually through a bridge and a mixer.
Attack (1 tx)
flash loan + manipulation
→
Loot
the hacker's net profit
→
Laundering
bridge → mixer → exchanges
How the attack differs from laundering
This is the key point of the lesson. A beginning analyst may see "$50M passed through the address" and log it as laundering — and be wrong.
- A flash-loan attack is a method of theft (predicate offence)The moment when the money is obtained. This is not laundering but the crime itself, the one that generates dirty funds.
- Laundering is what happens afterwardThe hacker moves the loot through cross-chain bridges, mixers (Section 3), peel chains (Lesson 7.1) to break the link. That is laundering.
- Borrowed capital ≠ dirty moneyThe $50M loan is not "dirty" — it went back to the lender. Trying to trace it as laundering is a methodological error. Only the net profit is dirty.
- Time scaleThe attack is fractions of a second in a single block. Laundering is hours, days, and weeks of chains. By timing they are easy to separate.
A practical conclusion for tracing. Having seen a flash-loan attack, do not chase the "body" of the loan — it is fictitious and returned to its place. Determine the net gain on the attacker's address after the transaction — this is the sum being laundered. Then trace that: where it went, through which bridge, into which mixer. Exposure from such an address carries the theft/hack category at maximum weight.
Why this is in the typologies section. A flash loan is not about laundering in the pure sense but about the source of the dirt. By understanding where the funds came from, you correctly classify the risk: an address that received even a share of such loot carries "stolen" exposure, and any KYC exchange will act on it at deposit.
The main takeaways
- A flash loan is a loan with no collateral, living inside a single transaction; if you do not return it, the transaction is rolled back.
- The attack uses the loan as a lever, most often to manipulate the price of an oracle drawn from a shallow pool.
- On the graph it is an "explosion" in one hash: loan = repayment, while the real loot is the clean remainder on the hacker's address.
- The attack itself is theft (the source of the dirt), not laundering; laundering comes afterward, through bridges and mixers.
- Trace not the body of the loan (it is fictitious) but the attacker's net profit, with the theft/hack category.
This material is for educational purposes.