FlashShield: Detecting Flash Loan Attacks in DeFi Using Hypergraph Neural Network

Abstract

The rapid growth of decentralized finance (DeFi) has spurred innovation but also exposed blockchain systems to severe security threats. As of November 2025, cumulative losses from blockchain security incidents have exceeded${\$}$36.89 billion. Flash loan attacks account for 135 reported cases and rank fourth among all attack methods. Existing detection approaches either analyze contract source code, which is unavailable for many deployed contracts, or use transaction pattern matching tailored to specific scenarios, and therefore generalize poorly to diverse flash loan attacks. In this paper, we presentFlashShield, a general flash loan attack detection framework based on Hypergraph Neural Networks (HGNNs). We construct comprehensive datasets containing attack and benign transactions across multiple chains, and systematically analyze flash loan attack mechanisms along four DeFi protocol layers: code implementation, business logic, economic mechanisms, and cross protocol interactions.FlashShieldrepresents each transaction as a hypergraph of transfer actions and semantic relations, and employs a hybrid architecture that integrates spectral, spatial, and original features together with both node level and graph level representations. Experiments show thatFlashShieldimproves recall by 29% over leading methods and identifies 43 previously unknown malicious or suspicious activities (18 confirmed flash loan-related exploits and 25 suspected address poisoning incidents), demonstrating its effectiveness and scalability for automated DeFi security monitoring.