How do flash loans work and why are they used in attacks?

Back when I was diving into DeFi experiments, flash loans blew my mind. A flash loan is a loan you can take out with no collateral at all, as long as you repay the borrowed amount within the same blockchain transaction. If you fail to repay, the whole thing reverts, like it never happened. That atomicity makes huge sums feel almost magical.

People use them for legitimate things: quick arbitrage, refinancing positions, or testing strategies without locking up capital. But because the loan doesn't require collateral, attackers saw a loophole: you can momentarily push a massive amount of value onto a protocol, move price feeds or collateral ratios, and then exploit the moment before the transaction ends. In practice, I watched a few projects get hit when oracles weren’t robust enough, and a single flash loan could swing prices or trigger liquidations. The lesson I learned was clear: trust lines and oracles need armor, TWAP, cross-checks, and fallback safeguards, to resist this kind of atomic attack. I stayed focused on defense, studying audits and safer design patterns instead of chasing flashy exploits.

Flash loans let you borrow large sums with no collateral, as long as you repay everything in the same transaction. I watched a DeFi incident where an attacker took out a big flash loan, swung a price oracle, and cleared profits in one block before repayment. They’re popular in attacks because they’re permissionless, atomic, and risk-free if timing works.

In my DeFi days, flash loans let you borrow massive sums in one block and repay instantly; attackers exploit oracles, so hardened feeds and audits save you.