At 08:50:59 UTC on 13 March 2023, in Ethereum block 16,817,996, a freshly deployed contract received 30 million DAI from Aave V2 as a flash loan, without posting a cent of collateral. Before the same transaction ended, the contract had sent the 30 million back, plus a fee of 27,000 DAI. In between, it had used the money to drain one of Euler’s lending pools. That was the first transaction of a series that, by Euler’s own count, took about 197 million dollars from the protocol that day. Every step of it can still be read on a block explorer.
A flash loan is an uncollateralised loan that must be borrowed and repaid inside one transaction, or the transaction never happens. The same tool sits behind ordinary buttons in DeFi apps. A user who clicks “blockchain, where users swap tokens directly from their own wallets without handing custody of their funds to a company.">swap collateral” on Aave is using a flash loan without being told. Once the code path is laid out, both the honest uses and the attacks make sense. In Euler’s case, as in most others, the loan paid for the exploit. It did not cause it.
One warning first, because the search results around this term are full of traps. A DeFi flash loan is not a cash loan you can apply for, and its money cannot be kept past the end of one transaction. Anyone selling “flash loan software”, a “flash loan app” that promises to fund your wallet, or “flash USDT” that stays in a wallet for weeks is selling a scam. The last section explains how that scam works; our guide on how to avoid crypto scams covers the wider family.
What a flash loan is: a loan that lasts one transaction
An Ethereum transaction is atomic. Either every instruction inside it succeeds, or the whole thing is reverted and the chain looks as if it never ran, except that the sender still pays for the gas burned. A flash loan builds on that property. The lender sends the tokens, lets the borrower’s code run, and checks at the end that the money is back with the fee. If it is not, the lender’s own code makes the transaction fail, and the tokens were, in effect, never lent.
That is why there is no collateral. A normal DeFi loan, as explained in our lesson on crypto lending and borrowing, asks the borrower to lock more value than they take, because the lender carries the risk that the borrower walks away. With a flash loan the lender carries no credit risk at all: a borrower who does not repay cannot leave with the funds, because without repayment the loan does not exist. The liquidity comes from the same pools that serve ordinary borrowers: depositors in an Aave smart contract holding reserves of two or more tokens, supplied by users, that a decentralized exchange uses to execute trades automatically at a price set by a formula.">pool are, without doing anything, the lenders of every flash loan drawn from it, even though in the current Aave V3 code the fee goes to the Aave treasury rather than to them.
The borrower is not a person filling in a form. It is a smart contract, a program deployed on the chain, that the lender calls back in the middle of the transaction. That contract runs inside the transaction, limited only by its gas budget, and must do something useful with the money (swap it, repay a debt, buy collateral) and end with enough tokens to settle. The previous lesson, on strategies for borrowing against crypto, showed positions built over days or months. A flash loan is the opposite end of the scale: a position that is opened, used and closed inside one transaction, so inside a single Ethereum block (one every 12 seconds).
This is also the extreme case of what DeFi people call composability, the ability of one contract to call several others in a row, covered in our lesson on DeFi composability and money legos. A flash loan lets a single transaction touch a lender, two exchanges and a lending protocol, and either all of those calls go through or none of them do.
Who offers flash loans and what they cost
Several protocols lend this way, with different fees and different callbacks. The table gathers the main ones, with the fees read in their documentation or on-chain as of 29 October 2026.
| Provider | How you call it | Callback your contract must implement | Fee (29 October 2026 unless stated) |
|---|---|---|---|
| Aave V3 | flashLoan (several assets) or flashLoanSimple (one asset) | executeOperation | 0.05% on Ethereum Core, read on-chain; waived for approved flash borrowers in flashLoan |
| Morpho Blue | flashLoan(token, assets, data) | onMorphoFlashLoan | zero |
| Balancer V3 | the Vault’s transient unlock, then sendTo and settle | your own function called by the Vault | zero, “fee-free by design” per Balancer’s docs |
| Uniswap V2 | swap() with non-empty data, a “flash swap” | uniswapV2Call | 0.3% LP fee, about 0.3009% when repaid in the same token |
| ERC-3156 lenders | flashLoan(receiver, token, amount, data) | onFlashLoan | set by each lender |
| Aave V2 (historical) | flashLoan | executeOperation | 0.09% in March 2023 (27,000 DAI on 30 million) |
Aave V3: flashLoan and flashLoanSimple
Aave is the largest of these lenders by deposits: DefiLlama put Aave V3’s total staking or liquidity, measured at current market prices. It is the main size metric in DeFi.">value locked at 16.26 billion dollars as of 29 October 2026. Its flash loan documentation says the fee was set at deployment to 0.05% and can be changed by a governance vote; the value stored in the Ethereum Core pool contract on 29 October 2026 is 5 basis points, so borrowing 1,000,000 USDC would cost 500 USDC (an example amount, not a quote). The code rounds the premium up. The documentation still says the fee can be shared between depositors and the treasury, with a protocol share that starts at zero; the current Aave V3 code (the aave-v3-origin repository) fixes that share at 100%, and the Ethereum Core pool returned exactly that value on 29 October 2026, so the whole premium is credited to the Aave treasury.
Aave has two entry points. flashLoanSimple lends one asset, charges the fee every time and must end with full repayment. flashLoan lends several assets at once and allows two extras: the fee is waived for addresses governance has approved as flash borrowers, and the borrower may end the transaction by turning the borrowed amount into an ordinary variable-rate debt instead of repaying it, provided it has collateral supplied or credit delegated to it. In that case, a comment in the code notes, no premium is charged at all.
Morpho and Balancer: zero-fee flash loans
Morpho Blue exposes a single function, flashLoan(token, assets, data), and calls back onMorphoFlashLoan in the borrower’s contract. Its contract documentation says the loan can draw on the contract’s whole balance of a token, liquidity and collateral of all markets combined, and that the flash fee is zero. Morpho is not fully ERC-3156 compliant, though its docs describe how compatibility is reached. With 11.19 billion dollars of total value locked on DefiLlama as of 29 October 2026, it is by far the deepest zero-fee lender in the table.
Balancer was for years the best-known zero-fee lender. Its fee documentation says governance could set a flash loan fee on V2 but always left it at zero, and that V3 flash loans, which run through the Vault’s transient accounting, are fee-free by design. The V3 contract opens a temporary state, lets the borrower pull tokens with sendTo, and requires a call to settle before the transaction ends. The depth is much smaller now: DefiLlama shows Balancer V2 at 17 million dollars and V3 at 15 million as of 29 October 2026, after the exploit of November 2025 described further down.
Uniswap flash swaps and the ERC-3156 standard
Uniswap V2 pairs do something similar under another name. According to Uniswap’s flash swap guide, a pair sends the output tokens before checking that it has been paid. If the caller passes non-empty data, the pair then calls uniswapV2Call on the receiving contract, and at the end it checks that its reserves, after the 0.3% fee, are at least what they were. Repaying in the same token works out at about 0.3009% of the amount taken. An underpayment rolls back the entire swap.
ERC-3156, a standard proposed in November 2020 and now final, gives flash lenders a common interface: maxFlashLoan, flashFee and flashLoan on the lender side, onFlashLoan on the borrower side, which must approve the repayment and return a fixed hash to prove it understood the call. Aave’s GHO stablecoin, for instance, can be flash-minted through this interface rather than borrowed from a pool.
Building an atomic transaction step by step
The mechanics are easiest to follow on Aave V3’s flashLoanSimple, whose code is public in the aave-v3-origin repository. Six things happen, all inside one transaction.
- Your wallet calls flashLoanSimple on the Aave Pool, naming the receiver contract, the asset, the amount and any parameters your code needs.
- The pool validates the request. A comment in Aave’s code explains that it then runs your code before updating its own accounting, an order chosen to protect against reentrance and rate manipulation inside the borrower’s payload.
- The pool transfers the asset to the receiver contract.
- The pool calls executeOperation on the receiver, passing the asset, the amount, the premium, the address that started the loan and your parameters. Your logic runs here: a swap, a repayment, a deposit.
- Your contract approves the pool for the amount plus the premium and returns true. The pool then pulls the repayment itself, rather than waiting to be paid.
- If the pull fails, or executeOperation returns false, the whole transaction reverts. Nothing changed on-chain except the gas you spent.
In step five the receiver does not send the tokens back by hand. The pool takes them, so the approval is what matters. Uniswap V2 is different again, because it only checks its reserves at the end.
The receiver contract in outline
Below is the shape of a receiver, written as pseudo-code to show the flow. It is not a contract to deploy, and it does nothing profitable.
contract FlashReceiver {
address POOL; // the Aave V3 Pool on your network
address OWNER; // you
// 1. You call this to start the loan
function start(address asset, uint256 amount) external {
require(msg.sender == OWNER);
POOL.flashLoanSimple(address(this), asset, amount, "", 0);
}
// 2. The pool calls this after sending you the tokens
function executeOperation(
address asset, uint256 amount, uint256 premium,
address initiator, bytes calldata params
) external returns (bool) {
require(msg.sender == POOL); // only the real pool
require(initiator == address(this)); // only loans you started
// ... your logic: swap, repay, deposit ...
// at the end you must hold amount + premium of asset
IERC20(asset).approve(POOL, amount + premium);
return true; // the pool now pulls the repayment
}
}The two require lines in executeOperation are the part people forget. Without the first, anyone can call your callback directly and make your contract act on fake data. Without the second, anyone can start a flash loan naming your contract as receiver and make it pay premiums or run logic you did not choose. Uniswap’s guide gives the same warning for its callback: check that the caller is a genuine pair.
Trying it on a testnet
Aave V3 runs on the Sepolia test network, with a Pool contract listed in Aave’s public address book and the same 0.05% premium as on mainnet, read on 29 October 2026. Test tokens come from the Faucet tab of Aave’s app once testnet mode is switched on, as Aave’s testing guide describes; Sepolia ETH for gas comes from third-party faucets. With a development framework such as Foundry or Hardhat, you can deploy a receiver like the one above, fund it with a few test tokens to cover the premium, and call start. Then try again without funding it: the transaction fails and the loan never existed, which is the whole lesson in one experiment.
Two things a testnet cannot teach. There is no real arbitrage to capture there, because prices on test pools mean nothing. And a mistake on mainnet costs real gas: the Euler attack transaction alone used 1,949,994 units of gas (our glossary entry on gas fees explains how that becomes a bill). No real money is needed to learn the mechanism, and none should be used until a receiver has been tested and reviewed.
Flash loan arbitrage, collateral swaps and other honest uses
Most flash loans are not attacks. They let someone without capital do in one block what would otherwise take capital, time and several transactions exposed to price moves in between.
Arbitrage
The textbook case: a token trades at 1.000 dollars on one exchange and 1.004 on another. A contract flash-borrows 500,000 USDC, buys on the cheap venue, sells on the expensive one, repays the loan and keeps the difference minus fees and gas (all numbers here are an example). If the gap closes before the transaction lands, the repayment check fails and the transaction reverts. Flashbots’ tutorial for searchers points out that a failed attempt sent through its system never lands on-chain and pays no fee, so gas is paid only on successful trades.
In practice that race is won by specialised bots and block builders, a topic for a later lesson on MEV. Anyone searching “is flash loan arbitrage still profitable” should know that public price gaps on large pools are usually closed within the block that creates them, and that a beginner competing with a copied script from a code-sharing site is more likely to pay gas, or to run a booby-trapped contract, than to earn.
Collateral swap, debt swap and repaying with collateral
This is where ordinary users meet flash loans. Aave’s swap features page describes adapter contracts built on its own flash loans and on the ParaSwap aggregator. A collateral swap flash-borrows an amount of the current collateral asset, swaps it into the new asset and supplies that on the user’s behalf, then withdraws the user’s old collateral to repay the loan: a user who had ETH as collateral can hold USDC instead without closing the debt. Repaying with collateral uses the loan to clear the debt first, then pulls the freed collateral and swaps it to settle. A debt swap re-borrows a different asset to repay the old debt. Collateral swaps and repayments with collateral also exist without a flash loan (swapAndDeposit and swapAndRepay), for cases where moving the collateral for a moment does not affect the position; the page lists no such version for debt swaps. GHO debt swaps rely on GHO’s flash minter instead of a pool.
Those adapters route through ParaSwap. When the interface’s separate token-swap feature uses CoW Protocol instead, the same page lists a fee: none on debt swaps, 15 basis points between correlated assets such as ETH and proof of stake coin with a protocol that stakes it for you and issues a transferable token (such as Lido stETH or rETH) representing the deposit plus rewards, which you can use or sell while the coins stay staked.">wstETH, 25 basis points on other pairs. Gas, and the flash loan premium where one is used, come on top.
Refinancing between protocols
The same logic moves a loan from one protocol to another, for example from Aave to Morpho when a borrow rate there is lower. The pattern runs in one transaction: flash-borrow the debt asset, repay the debt on the first protocol, withdraw the collateral, deposit it on the second protocol, borrow there, repay the flash loan. Without the loan the borrower would need enough spare cash to repay the debt before freeing the collateral. It is a pattern, not a named Aave feature; check what any tool that offers it actually does before signing.
Self-liquidation
A position close to liquidation can be unwound with a flash loan: borrow the debt asset, repay the loan, withdraw the collateral, sell enough to repay the flash loan. The borrower pays the flash fee and the swap costs instead of the liquidation bonus that a liquidator would take. Our lesson on liquidations explained covers who liquidates and what they take, including liquidators who fund their own work with flash loans. Keep this pattern in mind: the Euler attacker used a malicious version of it.
Flash loan attack anatomy: Euler, 13 March 2023
Euler was an Ethereum lending protocol where deposits were represented by eTokens and debts by dTokens. Two features mattered. Users could “mint”, creating eTokens and dTokens together to build a leveraged position in one call. And liquidations used a discount that grew as a borrower’s health worsened, so the deeper underwater a position was, the cheaper its collateral became for the liquidator.
The protocol had added a function, donateToReserves, that let a user give eTokens to the protocol’s reserves. Every normal transfer of eTokens ended with a check that the account was still solvent. This one did not. Euler’s own account of the incident, published in January 2024, says the function “lacked a health check”, which let a user make their own position unhealthy on purpose.
The transaction step by step
Security firm BlockSec reconstructed the best-documented transaction, the one funded by Aave V2. In outline, all within block 16,817,996:
- The attack contract flash-borrowed 30 million DAI from Aave V2.
- It deposited 20 million DAI in Euler and received about 20 million eDAI.
- It used mint to create about 195 million eDAI against 200 million dDAI, a leveraged position the rules allowed.
- It repaid 10 million of debt with the remaining DAI, then minted again, ending with roughly 410 million eDAI against 390 million dDAI.
- It donated 100 million eDAI to the reserves. With no health check, the account was left with more debt than collateral, and nothing reverted.
- A second contract controlled by the attacker liquidated the first. Because the discount grows as health falls, it took far more collateral than the debt it assumed (BlockSec counts 38 million eDAI extracted), withdrew the DAI from Euler’s pool and repaid Aave the 30 million plus 27,000 DAI.
The on-chain receipt matches: status success, 56 event logs, 31 of them emitted by Euler’s main contract. The same steps were repeated on other assets in further transactions until the protocol had lost about 197 million dollars in DAI, USDC, staked ether and wrapped bitcoin. Euler gives that figure; other analyses round it between 196 and 200 million dollars.
The flash loan’s role is clear from the list. It supplied the 20 million DAI deposit and the 10 million repayment. An attacker with 30 million dollars of their own could have run the same steps. What made the theft possible was step five: one function that changed a balance without checking solvency afterwards.
Negotiation and the return of funds
What followed was unusual. Euler’s January 2024 account says its team drew up a list of leads early on, from the attack contracts and the style of their code, and that on 17 March the attacker sent funds to an address the US Treasury’s OFAC had attributed to the North Korean Lazarus group, which complicated the picture. The attacker’s identity has not been made public.
| Date (2023, UTC) | Event | Source |
|---|---|---|
| 13 March, 08:50:59 | First attack transaction, block 16,817,996 | Ethereum, Euler |
| 17 March | Part of the funds sent to an address attributed by OFAC to Lazarus | Euler |
| 25 March | About 51,000 ETH, roughly 90 million dollars, returned | Euler |
| 27-28 March | Further ETH and DAI returned, including 5 million DAI on 28 March | Euler |
| 3 April, 22:49-22:59 | Final returns, including 12 million DAI and the remaining ETH | Euler |
| 4 April | Euler Labs says all recoverable funds have been returned; over 177 million dollars back in total | The Block |
The Block reported on 4 April 2023 that the final tranche was 10,580 ETH and about 12 million DAI, and quoted Euler Labs saying that “all of the recoverable funds taken from the Euler protocol on March 13th” had been returned. In its later account of the recovery, Euler puts the value recovered at about 240 million dollars, more than was taken, because the price of ether rose while the attacker held it.
One later claim belongs in the record as a claim. In September 2023 a pseudonymous whitehat known as Kankodu, who had reported a “first deposit” bug to Euler in July 2022, wrote that “the fix for a bug that I reported ended up introducing a function responsible for the hack”, as quoted by The Block on 6 September 2023. Euler’s own account confirms that donateToReserves was added to fix a first-depositor bug. Its chief executive, Michael Bentley, replied that the fix had been audited by a prior Euler auditor and implemented after a governance vote; Euler Labs did not comment on whether the report led to the attack.
Euler has since relaunched as Euler V2, with a total value locked of 276 million dollars on DefiLlama as of 29 October 2026, against zero for the original protocol.
Other flash loan attacks, from bZx to 2026
The pattern has repeated since flash loans became common, each time with a different bug in the victim.
| Date | Protocol | Reported loss | Role of the flash loan | Root cause |
|---|---|---|---|---|
| February 2020 | bZx (Fulcrum) | under 1 million dollars per attack; press figures vary | funded trades that moved DEX prices | collateral priced from manipulable DEX markets |
| 17 April 2022 | Beanstalk | about 182 million of protocol losses (media); about 77 million of user assets taken, per Beanstalk | rented a voting supermajority | voting power counted at the instant of the vote |
| 13 March 2023 | Euler | about 197 million dollars | funded the deposit and repayment | donateToReserves without a health check |
| 3 November 2025 | Balancer V2 | 128.64 million dollars | none described | rounding error in pool maths |
| 20 January 2026 | Makina Finance | about 4 million dollars (1,299 ETH) | 280 million USDC distorted a Curve pool | pool priced from manipulable spot prices |
| 6 July 2026 | Summer.fi (Lazy Summer) | about 6 million dollars | 65.4 million dollars, according to CertiK | share accounting of vaults manipulated |
The two bZx attacks of February 2020, within days of each other, were among the first flash-loan attacks to draw wide attention. According to auditor Quantstamp’s review, the first used dYdX’s flash loans and the second bZx’s own; in the second, the attacker pushed up the price of sUSD on the decentralised exchanges that bZx used to value collateral, then borrowed against the inflated sUSD. Reported losses differ between outlets, all below a million dollars per attack. Oracle manipulation of this kind, and the Mango Markets case, is covered in our lesson on advanced DeFi oracles; it is not repeated here. The short version: a protocol that reads a price from one pool lets anyone with enough capital for one block set that price, which is why time-weighted feeds and networks such as Chainlink are the usual defence.
Beanstalk, a stablecoin protocol, was hit through its governance on 17 April 2022, at about 12:24 UTC by its own account. The attacker had filed malicious proposals and waited out the 24 hours that Beanstalk’s emergency procedure required. Then a flash-loaned deposit gave it about 79% of the votes, above the two-thirds supermajority needed, according to security firm Halborn; the proposal was executed and its proceeds repaid the loan, all in one transaction. Media reports at the time, such as BleepingComputer’s, put the losses at about 182 million dollars, with about 80 million dollars of crypto assets taken by the attacker. Beanstalk’s own post describes the theft of about 77 million dollars of non-Beanstalk user assets from its liquidity pools. The lesson: any vote counted from token balances at a single instant can be rented for one block. Snapshots taken in advance and time-locks between a vote and its execution close that door.
The 2026 cases are smaller. On 20 January 2026, according to Decrypt, citing PeckShield, an attacker took a 280 million USDC flash loan to distort the pricing of Makina Finance’s DUSD-DUSDC pool on Curve, which relied on spot prices, and drained 1,299 ETH, about 4 million dollars; an MEV builder that front-ran the attack ended up with most of it. On 6 July 2026, The Block reported a loss of about 6 million dollars at Summer.fi’s Lazy Summer Protocol; the 65.4 million dollar flash loan figure comes from CertiK, which described a manipulation of the vaults’ totalAssets accounting, and Summer.fi had not yet confirmed the exploit when the article was published.
Why flash loans are not the problem
Read the root-cause column again. A missing solvency check, a price read from a pool anyone can move (the job of an oracle done badly), a vote counted at one instant, vault accounting that one large deposit could skew. In every case the flash loan did one thing: it gave an attacker without capital the capital the bug needed, for the length of a block. It is a key that anyone can rent. It never made the lock weak.
One of the largest DeFi exploits of 2025 makes the point. On 3 November 2025 an attacker drained 128.64 million dollars from Balancer V2 pools on six chains, according to Check Point Research, by batching many small swaps to compound a rounding error in the pool maths. Check Point’s analysis describes no flash loan. It was not a flash-loan attack, and it cost more than every 2026 flash-loan case in the table together.
Banning flash loans would also remove the honest uses above, and it would not stop a funded attacker. What reduces the damage sits in the victim’s code and governance.
- Read prices from time-weighted or aggregated oracles, such as Chainlink feeds, rather than from the spot price of one pool.
- Run a solvency or invariant check at the end of every function that changes balances, including the rarely used ones.
- Measure voting power at a snapshot taken before the proposal, and wait before executing it.
- Test invariants and pay for independent audits, knowing that Euler’s code had been audited and the flaw was still missed.
For a user, flash loans change one thing: a protocol’s weak point can be hit by anyone, at full scale, from day one. Our history of DeFi lists the larger hacks; reading a protocol’s audits, its caps and its incident history before depositing says more than whether flash loans exist on the chain.
Taxes and rules in the US and the UK
No tax authority we checked addresses flash loans by name. The loan itself is borrowed and repaid within seconds, so the question is what you end up holding. The US IRS treats digital assets as property: a disposal, including an exchange for another digital asset, must be reported whether or not it produces a gain, and the result is taxed as a capital gain or loss, or as ordinary income in a business context. An arbitrage profit may therefore be taxable even if it never touched a bank account. In the UK, HMRC’s Cryptoassets Manual on DeFi lending says the treatment depends on the operating model of each arrangement, that lending tokens may amount to a trade, and that without a trade there may be a disposal for capital gains. Our guides on crypto taxes in the United States and in the United Kingdom give the general rules; a tax adviser is the right person for a bot that trades every block.
Flash USDT and flash loan apps: the scams that borrow the name
A real flash loan leaves no balance behind: by the end of the transaction the money is either repaid or the transaction never happened. So any offer of tokens that stay in your wallet for weeks, a “flash loan app” that funds your account, or software that “generates” USDT is a scam. An explainer on flash USDT published by Plasma, a stablecoin blockchain, describes the tricks: counterfeit tokens carrying Tether’s name on cheap chains, transfers sent with fees too low to confirm that briefly show in a wallet, fake activation sites that ask for a fee or a seed phrase, and sellers in peer-to-peer trades who push the victim to release real crypto against a fake token.
The check takes a minute. Look up the token’s contract address on a block explorer and compare it with the address Tether publishes. A transfer that stays pending, or a token whose contract does not match, is worthless. Nobody needs to buy software to use a flash loan: the contracts of Aave, Morpho and Uniswap are public and free to call, and the only costs are the fee and the gas. The next lesson of this path moves from loans that last one block to loans with a fixed rate and a fixed term.
