Flash loan >$10M targeting protocol tokens

Methodology how we score #

**What this measures** This real-time signal fires when a flash loan origination exceeding $10M is observed in the mempool or on-chain, where the loaned assets are protocol tokens or LP tokens, or where the subsequent transaction flow is directed toward the monitored protocol. The $10M threshold is configurable per protocol tier. Flash loan originations are detected via mempool monitoring combined with known flash-loan-provider event signatures (Aave, dYdX, Balancer, Uniswap V3). Category 6 context: while flash loans are legitimate DeFi infrastructure, their combination with protocol-token denomination and immediate protocol interaction is the defining pattern of the flash-loan-amplified exploit class.

**Why it matters** Flash-loan-amplified exploits account for more than 20 data points in the T-01 hack database, representing the largest single on-chain exploit class. Cetus Protocol ($223M) initiated flash loans of 56,700 SUI at exploit start, repeated for each subsequent pool. Euler Finance ($197M) involved flash loans combined with leverage-creating eToken/dToken positions in a single block. PancakeBunny ($45M) used eight simultaneous flash loans from different providers — a highly anomalous pattern. The synthesis document notes: "Flash loans are infrastructure, not a signal" — but flash loans correlated with protocol-token interaction and large notional size cross the threshold into a meaningful exploit-in-progress indicator.

**Green / Yellow / Red** Green is the baseline when all flash loan originations directed at the protocol are below the threshold or involve non-protocol assets in patterns consistent with legitimate arbitrage. Yellow fires when a large flash loan originates targeting protocol-adjacent assets but the subsequent transaction pattern is not consistent with known exploit templates. Red fires when a flash loan exceeding $10M in protocol tokens originates and the subsequent transaction flow matches known-exploit-class interaction patterns (oracle manipulation, governance attack, reentrancy setup).

**Common gray cases** Gray applies when the protocol itself uses flash loans as a core mechanism (e.g., a flash-loan provider protocol), making it impossible to distinguish internal from external flash loan originations.

**Notable historical examples** - **Cetus Protocol** ($223M, 2025): Flash loan of 56,700 SUI at exploit initiation; repeated for each subsequent pool drain. - **Euler Finance** ($197M, 2023): Flash loans combined with leverage positions in a single block; extreme eToken/dToken imbalance. - **Fei/Rari Fuse** ($80M, 2022): Large flash loans followed by immediate borrow-and-exit sequences. - **PancakeBunny** ($45M, 2021): Eight simultaneous flash loans from different providers — highly anomalous. - **Harvest Finance** ($33.8M, 2020): $50M flash loan from Uniswap initiated each of the 32 manipulation cycles.

Measurement what to look for #

Detect whether a flash loan >$10M denominated in protocol tokens or LP tokens has originated, likely to interact with this protocol.

Data & output #

Scored protocols 80 carry this factor #

Linked hacks 32 historical incidents #