A flash loan is a loan that is borrowed and repaid in the same transaction. You can borrow an arbitrarily large amount of tokens — tens of millions of dollars, sometimes hundreds of millions — with no collateral whatsoever, as long as you return the loan (plus a small fee) before the transaction finishes. If you fail to return it, the entire transaction is reverted by the blockchain’s atomic execution, and it is as if you never borrowed anything in the first place. The protocol never loses anything because the loan only “counts” if the repayment succeeds.
This is a primitive that has no analogue in traditional finance. A bank cannot offer a loan that unwinds itself if you fail to repay within ninety seconds, because banks do not run inside a transactional database where partial failure rolls back everything. A blockchain does. Aave and a few other DeFi lending protocols introduced flash loans around 2020 and they have been a staple of on-chain activity ever since.
What They Are Actually Used For
Three things, mostly. The first is arbitrage. If the same token is priced differently on two DEXes, you can borrow a large amount, buy on the cheap one, sell on the expensive one, repay the loan, and keep the difference. All in one transaction. No capital required. This is how most DEX arbitrage actually works — specialised bots scan for price discrepancies and execute flash-loan-funded trades every block.
The second is collateral swaps and debt refinancing. If you have an Aave position collateralised with ETH and you want to switch to WBTC collateral, you can flash-borrow the WBTC, close your ETH position, open a WBTC position, and repay the flash loan — all atomically, without ever needing to hold the WBTC yourself outside the transaction.
The third is attacks. Because a flash loan gives you temporary control over a large amount of capital, it is a useful tool for manipulating on-chain oracles or draining poorly-designed lending pools. The bZx attacks in 2020, the Harvest Finance drain, the Cream Finance hack, and several other exploits all used flash loans to amplify what would otherwise have been smaller attacks into nine-figure losses. The loan itself is not the vulnerability — the vulnerability is usually a bug somewhere else that becomes exploitable once the attacker has enough capital. But flash loans democratise access to that capital in a way that makes previously-theoretical attacks practically executable.
Why They Are Fine
Despite the attack surface, flash loans are not considered a design mistake in DeFi. The arbitrage use case keeps DEX prices in line with each other, which benefits ordinary users. The collateral swap use case is a genuine productivity improvement for anyone managing on-chain positions. And the attack use case is really an argument that the underlying vulnerabilities should not exist, not that the flash loan primitive should be removed.
If you are using DeFi normally you may never encounter flash loans directly. If you are building a protocol, you need to assume that any price oracle that can be gamed by a large temporary buyer will be gamed, and design accordingly.