Flash loan >$10M targeting protocol tokens

Methodology how we score#

What this measures
This real-time signal fires when a flash loan origination exceeding $10M is observed in the mempool or on-chain, where the loaned assets are protocol tokens or LP tokens, or where the subsequent transaction flow is directed toward the monitored protocol. The $10M threshold is configurable per protocol tier. Flash loan originations are detected via mempool monitoring combined with known flash-loan-provider event signatures (Aave, dYdX, Balancer, Uniswap V3). Category 6 context: while flash loans are legitimate DeFi infrastructure, their combination with protocol-token denomination and immediate protocol interaction is the defining pattern of the flash-loan-amplified exploit class.

Why it matters
Flash-loan-amplified exploits account for more than 20 data points in the T-01 hack database, representing the largest single on-chain exploit class. Cetus Protocol ($223M) initiated flash loans of 56,700 SUI at exploit start, repeated for each subsequent pool. Euler Finance ($197M) involved flash loans combined with leverage-creating eToken/dToken positions in a single block. PancakeBunny ($45M) used eight simultaneous flash loans from different providers — a highly anomalous pattern. The synthesis document notes: "Flash loans are infrastructure, not a signal" — but flash loans correlated with protocol-token interaction and large notional size cross the threshold into a meaningful exploit-in-progress indicator.

Green / Yellow / Red
Green is the baseline when all flash loan originations directed at the protocol are below the threshold or involve non-protocol assets in patterns consistent with legitimate arbitrage. Yellow fires when a large flash loan originates targeting protocol-adjacent assets but the subsequent transaction pattern is not consistent with known exploit templates. Red fires when a flash loan exceeding $10M in protocol tokens originates and the subsequent transaction flow matches known-exploit-class interaction patterns (oracle manipulation, governance attack, reentrancy setup).

Common gray cases
Gray applies when the protocol itself uses flash loans as a core mechanism (e.g., a flash-loan provider protocol), making it impossible to distinguish internal from external flash loan originations.

Notable historical examples
- Cetus Protocol ($223M, 2025): Flash loan of 56,700 SUI at exploit initiation; repeated for each subsequent pool drain.
- Euler Finance ($197M, 2023): Flash loans combined with leverage positions in a single block; extreme eToken/dToken imbalance.
- Fei/Rari Fuse ($80M, 2022): Large flash loans followed by immediate borrow-and-exit sequences.
- PancakeBunny ($45M, 2021): Eight simultaneous flash loans from different providers — highly anomalous.
- Harvest Finance ($33.8M, 2020): $50M flash loan from Uniswap initiated each of the 32 manipulation cycles.

Measurement what to look for#

Detect whether a flash loan >$10M denominated in protocol tokens or LP tokens has originated, likely to interact with this protocol.

Data & output #

Scored protocols 0 carry this factor#

Linked hacks 32 historical incidents#