What is a flash loan? It’s a DeFi loan with no collateral that must be borrowed and repaid within a single blockchain transaction. If the money plus a small fee isn’t back in the lending pool by the end of that transaction, the whole thing is cancelled as if it never happened, so the lender can’t lose. That one rule makes flash loans useful for arbitrage, refinancing and liquidations. It also lets attackers borrow huge sums for a few seconds to exploit bugs in other protocols. Ordinary users rarely profit from them directly.
Key takeaways
- A flash loan is atomic: borrowing, using and repaying happen in one transaction, or nothing happens at all.
- Because the loan can’t outlive the transaction, the lender needs no collateral, and borrowers need code, usually a smart contract, to use one.
- Fees vary by provider. Aave V3 set its flash loan fee at 0.05% at deployment, adjustable by governance; Morpho’s documentation says its flash loans are free.
- Flash loan attacks don’t break the lender. They give an attacker capital to exploit a flaw elsewhere, most often a manipulable price oracle.
- “Flash loan arbitrage bot” tutorials and “flash USDT” offers are scams.
What is a flash loan? The one-transaction rule
Ordinary loans rely on trust or collateral because time passes between borrowing and repaying, and the borrower could disappear. On blockchains like Ethereum, a transaction is all-or-nothing. If any step fails, every step reverts, including the transfer of borrowed funds. A flash loan uses that property: the lending contract sends you the tokens, lets your code run, then checks its own balance. If the loan and fee aren’t back, it throws an error and the entire transaction is undone.
From the lender’s point of view, there is no scenario in which the money leaves and doesn’t return. The worst case is a failed transaction, and the borrower still pays the gas for that attempt. That is why a flash loan can be for millions of dollars with no credit check and no deposit.
The catch is that the money only exists for you within that single transaction. You can’t withdraw it to an exchange or hold it overnight. Whatever you do with it has to be programmed in advance and must finish profitably, or at least break even, before the transaction ends. For a broader look at borrowing in crypto, including the collateral-free offers that are really scams, see our guide to crypto loans.
Inside a flash loan, step by step
Follow one simplified arbitrage transaction from start to finish. Suppose ETH trades at $2,990 on one DEX and $3,010 on another. The numbers are illustrative and ignore slippage.
- The call. A user’s smart contract calls the lending pool’s flash loan function, asking for 1,000,000 USDC.
- The transfer. The pool sends 1,000,000 USDC to the contract and immediately calls a function in that contract, handing over control.
- The work. The contract buys about 334.4 ETH on the cheaper DEX, then sells it on the more expensive one for about $1,006,690.
- The repayment. The contract approves the pool to pull back 1,000,000 USDC plus the fee. At 0.05%, that’s $500.
- The check. The pool confirms its balance is restored. If it is, the transaction completes and the contract keeps roughly $6,190 before gas. If the price moved and the trade lost money, the repayment step fails and everything reverts.
All of this happens in one block, within the same transaction. In reality, the slippage from moving $1 million through two pools would eat most of that gap, and dozens of automated searchers would be competing for the same opportunity. That competition is part of what’s called MEV, covered in our explainer on what MEV is.
Who offers flash loans and what they cost
As of October 2026, these are the main sources. Fees can change through governance, so developers should read the live value on-chain rather than hard-coding it.
| Source | How it works | Fee (as documented) |
|---|---|---|
| Aave V3 | Borrow one or several assets from a market’s reserves | Set at 0.05% at deployment; changeable by governance (contracts expose the current value as FLASHLOAN_PREMIUM_TOTAL) |
| Morpho | Flash loans from the singleton Morpho contract across all its markets | Free, according to Morpho’s documentation |
| Uniswap | “Flash swaps”: receive tokens from a pool before paying for them | Pay the pool’s swap fee (or return the tokens with the fee) |
| Maker / Sky | A flash-mint module creates stablecoins for one transaction and destroys them on repayment | Set by governance; check current parameters |
| Balancer | Flash loans from its central Vault | Historically no protocol fee, but Balancer is winding down after its November 2025 exploit |
Aave V4 went live on Ethereum in late March 2026 with a new hub-and-spoke structure, while V3 markets remain in use. If you’re building on V4, check its own documentation for flash borrowing rather than assuming V3 behaviour. Our Aave explainer covers how the two versions differ.
What flash loans are used for
Legitimate uses mostly involve rearranging positions in one step that would otherwise need capital you don’t have:
- Flash loan arbitrage. Profiting from price gaps between venues, as in the example above. In practice, this is dominated by specialised bots.
- Collateral swaps. Changing the collateral behind a loan, for example from ETH to a staked-ETH token, without first repaying the debt: borrow, repay, withdraw old collateral, swap, deposit new collateral, borrow again, repay the flash loan.
- Debt refinancing. Moving a loan from one lending protocol to another with a lower rate in a single transaction.
- Self-liquidation. Closing your own risky position before a liquidator does, which can avoid the liquidation penalty.
- Liquidations. Liquidation bots borrow the repayment asset, repay an undercollateralised loan, receive the discounted collateral, sell it and repay the flash loan.
Most ordinary users only meet flash loans indirectly. Position-management tools such as DeFi Saver use them behind the scenes to change leverage or migrate positions in one click. If you use such a tool, you’re trusting its contracts with approvals over your position, so the usual approval and revoke hygiene applies.
How flash loan attacks work
A flash loan attack is really an attack on something else, with a flash loan as the funding. The most common pattern exploits protocols that trust a price they can be tricked into reading.
The oracle-manipulation pattern
- Flash-borrow a large amount of a stablecoin.
- Use it to buy token X in a small DEX pool, pushing X’s spot price far above its real value.
- A vulnerable lending protocol reads that same pool as its price oracle, so it now values X collateral at the inflated price.
- Deposit X (bought earlier or during step 2) as collateral and borrow other assets against the inflated value.
- Sell X back to restore the pool roughly to where it was, repay the flash loan, and keep the borrowed assets. The lending protocol is left with bad debt.
All five steps happen in one transaction, so the price distortion lasts only for that transaction.
Real cases
- bZx, February 2020: two attacks a few days apart used flash-borrowed funds to manipulate prices across several protocols. Analysts at the time stressed that the flash loans worked exactly as intended; the weakness was bZx’s pricing.
- Cream Finance, 27 October 2021: about $130 million was lost in an attack combining flash loans from MakerDAO and Aave with a share-price manipulation.
- Euler Finance, 13 March 2023: roughly $197 million was drained using flash loans and a flaw in a donation function. The attacker later returned what Euler described as all recoverable funds.
- Makina Finance, 20 January 2026: an attacker flash-borrowed hundreds of millions of USDC to distort Curve pool data used in Makina’s valuation, with losses estimated at roughly $4–5 million.
The lesson in each case: flash loans amplify existing flaws. Without them, an attacker would need the capital themselves; with them, anyone with the right code can try. Protocols defend against this by using robust oracle networks, time-weighted prices and sanity checks rather than single-pool spot prices.
Flash loan bot and ‘flash USDT’ scams
Because “borrow millions with no collateral” sounds like free money, scammers use it as bait. Two schemes are especially common:
Fake “flash loan arbitrage bot” tutorials
Videos, often on YouTube, show you how to deploy a “profitable arbitrage bot” contract by pasting code into Remix and funding it with ETH “for gas”. The code contains a hidden address that lets the scammer withdraw your deposit. In August 2025, SentinelLABS documented one such campaign, which posed as a trading bot and had taken more than $900,000 from victims; it used aged accounts, AI-generated narration and heavily moderated comments to look trustworthy. Any contract that asks you to send funds into it so it can “find arbitrage” should be treated as theft.
“Flash USDT” and fake balances
Sellers offer software that “flashes” USDT into a wallet, supposedly spendable for a few days. Nothing real is sent. The balance is either faked by spoofed wallet software or a fake explorer, or it’s a worthless token named USDT, and some versions trick you into approving a contract that then drains your genuine tokens. Real flash loans can’t leave a transaction, so a “flash” balance that lasts days is impossible.
If you’ve lost money to one of these, report it to the FBI’s Internet Crime Complaint Center (ic3.gov) and the FTC (reportfraud.ftc.gov) if you’re in the US, or your national fraud agency elsewhere. Be wary of anyone who then offers to recover your funds for a fee. Our crypto scams guide covers recovery-scam warning signs, and more DeFi explainers are in the DeFi hub.
FAQ
Can a regular person use an Aave flash loan?
Technically yes, but you need a smart contract that receives the funds, does something useful and repays them within the same transaction. Aave’s app doesn’t offer a raw flash loan button, although its built-in collateral and debt swap features rely on flash loans behind the scenes, as do some third-party position managers. Writing your own carries real risk of losing gas or funds to bugs.
Is a flash loan an uncollateralised loan in DeFi?
Yes. Flash loans are the main form of uncollateralised loan in DeFi, but only because the loan can’t outlast a single transaction. Any offer of collateral-free crypto loans you can withdraw and keep is not a flash loan and is very likely a scam or an advance-fee fraud.
Is flash loan arbitrage profitable?
Occasionally, for sophisticated operators. Obvious price gaps are spotted by professional bots within milliseconds, and those bots pay block builders for priority. Slippage, gas and failed attempts eat into the rest. For an individual copying a tutorial, the realistic outcome is spending gas on reverted transactions, or losing funds to a scam contract.
What is a flash mint?
A flash mint is a variation where a protocol creates its own token for the length of one transaction instead of lending existing reserves. Maker introduced this for DAI: the module mints the stablecoin, your contract uses it, and it must be returned and burned before the transaction ends. The same all-or-nothing rule applies.
Crypto is volatile and risky; this is education, not financial advice. Do your own research.
