Flash Loans Expose Growing Gap in DeFi Insurance

Flash loans themselves are not the problem — vulnerable code is

article-image

whitehoune/Shutterstock.com modified by Blockworks

share

Flash loan attacks are not common — but their consequences are dire.

Most recently, decentralized finance (DeFi) lending and borrowing protocol Euler Finance booked a $197 million loss in a flash loan attack.

The attacker exploited a vulnerable code, Euler Labs, the team behind the Euler Finance protocol, said in a tweet, tricking it into believing there were fewer collateral tokens than debt tokens.

“As a result, the attacker was able to liquidate these underwater accounts and profit from the liquidation bonuses,” the company tweeted

Hugh Karp, the founder of Nexus Mutual, a smart contract insurance company, told Blockworks that flash loans themselves —  where traders are able to borrow cryptocurrencies without any collateral and return assets within the same transaction — are not the problem.

“Flashloans sound sexy, but all flash loans do is allow a hacker to conduct the attack without having spare funds lying around,” Karp said. “The attack would have been exploitable without the use of flash loans.”

Blockworks Research analyst Ren Yu Kong said that, ultimately, a fundamental vulnerability exists within the smart contract for a flash loan attack to happen. 

“Flash loan attacks are as preventable as any other attack vector, and at the day it still requires developers to go through various security audits and take into account flash loans as an attack vector when writing the code,” Kong said.

The real problem, though, according to Karp, is whether humans are capable of creating secure software free of defects. 

“While that’s possible, it is quite difficult as even the most security-focused teams, such as NASA and teams within the aviation industry, struggle with this,” Karp said.

Even if DeFi security continues to improve, the possibility of failure is rather inevitable — at some point. 

“DeFi cover providers have to be very careful with their risk selection and in their risk management practices, like setting exposure limits and adequately pricing risk. There are no shortcuts,” Karp said.

Jesse Pollack, Coinbase’s protocol lead, said in a tweet that in order to prevent further attacks, “better insurance primitives and coverage need to be a part of the solution.”

Existing DeFi insurance is underpriced, according to Kong — considering it’s often marketed as yield, though the costs associated with an insurance premium could potentially outweigh the downside protection it provides.

“That’s a combination of exploits in DeFi generally being all or nothing — if a protocol gets exploited, more often than not everything is gone — and a much higher percentage chance of an exploit occurring than insurance underwriters price,” Kong said. 

Another solution, a Twitter user who goes by Duncan said, is bringing in more audits to cover soft exploits, adding that there are a “ton of different examples right now” along those lines.


Get the news in your inbox. Explore Blockworks newsletters:

Tags

Decoding crypto and the markets. Daily, with Byron Gilliam.

Upcoming Events

Javits Center North | 445 11th Ave

Tues - Thurs, March 24 - 26, 2026

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

Old Billingsgate

Mon - Wed, October 13 - 15, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

recent research

Unlocked by Template (1).jpg

Research

As AI supercharges surveillance, privacy becomes a prerequisite and the winning stack will combine confidentiality with selective disclosure. Zcash’s Tachyon, composable standards on Ethereum/Solana, and compliance-aware pools aim to make private rails the new norm.

article-image

Pipe’s testnet has delivered 60+ PB of data across ~290,000 Point of Presence (PoP) nodes

article-image

375ai will hold TGE at the end of the month, CEO Harry Dewhirst told Blockworks

article-image

Block’s subsidiary adds direct Bitcoin integration and AI-powered ordering tools for small businesses seeking streamlined transactions

by Blockworks /
article-image

The deal integrates Dinero’s staking suite into Plume’s real-world asset platform as it gains SEC transfer agent status

by Blockworks /
article-image

The state’s decision opens staking access to New Yorkers, signaling a regulatory shift toward broader crypto participation

by Blockworks /
article-image

The startup says it aims to rival Stripe and Worldpay by using stablecoins to speed merchant settlements from days to seconds

by Blockworks /