What is a flash loan, and why is it in so many exploits?

A stranger with no collateral and no credit history borrows enough to move a market. The money passes through three protocols and comes back with a small fee on top, all within one transaction. It is a flash loan, and it works exactly as designed.

What is a flash loan?

A flash loan is an uncollateralised loan that must be borrowed and repaid inside a single blockchain transaction. If the money and the lender's fee are not back by the final step of that transaction, the whole transaction reverts as if it never happened, and the loan reverts with it. The lender takes no credit risk: either it is repaid within the transaction or it never lent anything.

Flash loans went into production on Ethereum in early 2020, when the lending protocol Aave launched them in its first version. Several lending pools and exchange protocols in decentralised finance (DeFi) now offer something similar, and each protocol sets its own fee.

How can a loan need no collateral?

Atomicity makes the collateral unnecessary. A transaction on Ethereum and chains built like it either completes every step it contains or completes none of them, so no halfway state is ever recorded. A flash loan puts the borrowing, everything done with the money and the repayment inside that one indivisible unit. Default is not a possible outcome.

Ordinary lending cannot work this way because a bank loan runs for months, and the borrower's plans play out in the real world. A flash loan runs for the length of a single transaction, and the lender's contract checks its own balance on the last step. That balance check replaces the credit assessment.

What are flash loans used for legitimately?

Most flash-loan activities are routine work that would otherwise need capital the user does not have. Arbitrage is the familiar case: a price gap between two venues is closed with borrowed funds, and the loan is repaid from the difference. Refinancing is another. A borrower can clear a loan on one protocol, and move the collateral to the same position elsewhere in one step, without first finding the cash to repay the old debt.

Collateral swaps and self-liquidation follow the same pattern. The common thread is that a large balance becomes something anyone can hold for a few seconds, not a privilege reserved for whoever already owns it.

Why do flash loans appear in so many exploits?

Flash loans rarely create a vulnerability; they make one affordable. A flaw that needs a huge balance for a few seconds used to be open only to someone who already held that balance. With a flash loan, anyone able to write the transaction can rent the size. The Open Worldwide Application Security Project (OWASP) ranks flash-loan-facilitated attacks fourth in its Smart Contract Top 10 for 2026 and describes them as same-transaction borrowing used to amplify an underlying weakness.

The shape of these attacks is consistent. An attacker borrows a large sum and uses it to push something a protocol trusts. The shift unlocks value, the attacker takes it, and the loan is repaid with the difference kept. The thing being pushed is usually one of three: a price read from a single pool, an accounting calculation that assumes deposits arrive gradually, or a governance vote weighted by tokens held at the moment of voting.

Price is the classic target. A protocol that reads an asset's price from one automated market maker (AMM) (opens in a new tab) pool can be fed a distorted figure through one large trade in that pool, which is the oracle (opens in a new tab) failure in its most direct form. Governance is the less obvious one. If voting power is counted at the instant of a vote, borrowed tokens can carry a proposal (opens in a new tab) and be handed back before anyone else can respond.

What stops a flash-loan attack?

Protocol designs that refuse to trust a single moment stop most of them. A time-weighted average price reads an asset across many blocks, and a loan that lives inside one transaction cannot move a multi-block average in any meaningful way. Governance systems defend themselves the same way: they count voting power from a snapshot taken before a proposal opens, then hold a timelock before anything executes.

An audit (opens in a new tab) helps only when its scope covers the protocol's outside dependencies, since an attack of this kind often passes through contracts that each look sound on their own. Banning flash loans would not close the underlying flaw either. An attacker with enough capital of their own could run the same sequence without borrowing at all.

Where Northtape fits

Northtape lends nothing, offers no flash loans and executes no transactions.

## FAQs

Can an ordinary person take out a flash loan? Only through a smart contract that borrows, acts and repays within one transaction. There is no form and no credit check, but there is also no way to keep the money past the end of that transaction.

What happens if the borrower cannot repay? The transaction fails, and every step reverts, including the loan. The borrower still pays the network fee for the failed attempt, while the lender ends exactly where it started.

Are flash loans illegal? The chain does not prohibit them, and most uses are routine. Using one to drain a protocol is a separate question that depends on the jurisdiction and the facts, and no single answer covers every market.

Do flash loans exist outside Ethereum? Yes, on chains whose transactions can call several contracts in sequence and revert as one unit. A ledger that does not allow those chained calls inside a transaction leaves no room for one.

None of this is investment advice. It describes how a lending mechanism works, not whether to use one, lend into one or hold any token linked to one. Nothing here suggests where any price may go next.