A flash loan is borrowed and repaid within a single blockchain transaction, with zero collateral required. If the loan is not repaid before the transaction completes, the entire transaction reverts, meaning from the blockchain’s perspective, it never happened. The lender bears no credit risk at any point.
How flash loans work
Protocols like Aave offer flash loans with a 0.09% fee. In a single atomic transaction, you can borrow up to the full pool liquidity, potentially millions of dollars, execute any series of on-chain actions, and repay the loan plus fee, all within one Ethereum block (roughly 12 seconds). If any step fails and the loan cannot be repaid, the entire transaction reverts. The lender’s funds return untouched.
This atomicity, all-or-nothing execution within a single transaction, is only possible on blockchains. There is no traditional finance equivalent. In conventional lending, a borrower’s failure to repay triggers a recovery process that takes days or longer.
What this means for traders
For most retail traders, flash loans are background knowledge rather than a tool to use directly. Their practical relevance is as a security awareness issue. Flash loans have been weaponized in some of the largest DeFi exploits, giving attackers enormous temporary capital with zero upfront cost.
The Beanstalk exploit (April 2022) is the clearest example: an attacker borrowed enough governance tokens via a flash loan to achieve a majority voting position in a single transaction, passed a malicious governance proposal that drained $182 million from the protocol, and repaid the loan. The entire attack took 13 seconds. No collateral was posted at any point. For broader context on DeFi security, see DeFi lending risks and crypto fraud prevention.
A concrete example
Classic flash loan arbitrage: USDC/ETH prices differ slightly between Uniswap ($3,000) and Sushiswap ($2,994). Borrow 1,000,000 USDC in a flash loan, buy ETH on Sushiswap (cheaper), sell ETH on Uniswap (higher price), collect $2,000 profit, repay the 1,000,000 USDC plus $900 fee, keep $1,100 net, all in one transaction. The opportunity exists for seconds and requires a custom smart contract to execute. By the time most arbitrageurs spot the price difference manually, bots have already closed it.
Frequently asked questions
Can regular traders use flash loans?
Not without writing a smart contract. You need to code the borrow, trade, and repayment sequence in a single transaction. No-code tools like DeFi Saver and Instadapp offer flash-loan-based position management (refinancing debt, self-liquidation) but not custom arbitrage. For most retail traders, flash loans are a risk to be aware of in protocols you use, not a tool to use yourself.
Are flash loans legal?
The loans themselves are protocol features, not legally regulated. Using flash loans to manipulate markets or exploit protocol vulnerabilities sits in legally grey territory and has attracted regulatory attention in several jurisdictions. Pure arbitrage through flash loans is generally treated as legitimate market activity.
How do protocols defend against flash loan attacks?
Time locks on governance (delays between proposal passage and execution) are the main defence against governance attacks. Price oracle improvements, using time-weighted average prices (TWAPs) rather than spot prices, reduce the effectiveness of flash loan price manipulation in lending protocols. Neither defence is foolproof, which is why smart contract audits remain essential for any protocol holding significant user funds.
