Platypus Finance hack — February 2023

On 16 February 2023 at 19:16:54 UTC, the Avalanche stableswap protocol Platypus Finance was drained through a logic error in its MasterPlatypusV4 staking contract.

The attacker flash-borrowed about 44 million USDC, deposited it as collateral, minted roughly 41.79 million of Platypus's USP stablecoin against it, then called emergencyWithdraw to pull the collateral back out. The solvency check in that function ran before the staked LP balances were updated, so the withdrawal succeeded while the USP debt remained unpaid. The attacker then liquidated the USP across Platypus's stablecoin pools. Auditor Omniscia, which published the technical post-mortem, confirmed the standard withdraw function performed the same checks in the correct order and that the exploited contracts had never been in scope of any audit it conducted. Two further transactions reused the same bug.

Figures differ by what is counted. Platypus's own accounting put the total at $9.19 million across three attacks: roughly $8.5 million in the first, about $380,000 in the second and about $287,000 in the third. CoinDesk's tally of all three came to $9.2 million. Omniscia's $8.5 million is narrower still: it is an estimate of profit retained from stablecoin liquidations and explicitly excludes the USP component as indeterminate in value, so it is a partial count rather than a lower estimate of the same total.

Within 24 hours Platypus and BlockSec executed a counter-transaction recovering about $2.4 million in USDC, and Tether froze $1.5 million in USDT. Platypus guaranteed users a minimum 63% of funds, rising to about 78% if the frozen USDT was reminted and an Aave governance proposal passed, and opened a compensation portal.

Two French brothers were arrested and prosecuted over the incident. On 3 December 2023 a Paris court acquitted both in full, holding that calling a publicly available smart contract's emergency withdrawal function constituted neither fraud nor unauthorised access to a computer system. No criminal culpability was established; the court noted Platypus could still pursue civil remedies.