A flash loan attack occurs in decentralized finance (DeFi), where attackers borrow large amounts of cryptocurrency in a single transaction without providing collateral by using flash loans. These loans must then be repaid within the same blockchain transaction. This should ideally make them safe for lenders, however, they are used to manipulate markets or exploit vulnerabilities.
Attackers use smart contracts on platforms like Aave or dYdX to borrow instantly. They use the borrowed crypto to manipulate market prices on decentralized exchanges by either inflating or crashing value. They take advantage of this price difference or take money out of liquidity pools. But because everything happens in one block, the exploit can take place within seconds. Such attacks happen when markets are unstable or when protocols have bugs, like when an oracle price is changed.
You can identify such attacks when you see a lot of borrowing happen all at once, followed by quick trades and repayments in the same transaction. Etherscan and other tools can help you find these strange spikes in trading volume or sharp price changes. Other security monitoring services also point out these kinds of patterns.