Platypus Finance
Summary
Platypus Finance is an Avalanche-based stablecoin automated market maker (AMM) and issuer of the USP stablecoin that suffered three separate exploits in 2023, losing a combined total of approximately $11.75 million. The first and most severe attack in February 2023 exploited a logic flaw in the protocol's emergency withdrawal function, draining roughly $8.5–9.1 million and causing the USP stablecoin to lose its dollar peg. Two French brothers identified by blockchain investigator ZachXBT were arrested and later acquitted on criminal charges after one argued he was an 'ethical hacker'; as of 2024 the protocol's total value locked had collapsed from over $200 million at peak to below $100,000.
Connected Entities
1 entities · 10 linked investigations- + 4 more
Timeline(14 events)
2021-12-01
Platypus raises $3.3 million seed round at $24 million valuation; investors include Three Arrows Capital and Avalanche Labs.
CryptoRank2023-02-16
First exploit: attacker drains approximately $8.5–9.1 million via flash loan attack exploiting emergencyWithdraw logic flaw in MasterPlatypusV4. USP stablecoin depegs to ~$0.48. All pools paused.
CoinDesk / CoinTelegraph2023-02-17
BlockSec recovers $2.4 million USDC by exploiting a flaw in the attacker's own contract. Tether freezes approximately $1.5 million USDT linked to the attack.
BlockSec / CoinDesk2023-02-17
ZachXBT publishes on-chain analysis linking attacker wallet to a Twitter account and a KYC-verified Binance account, identifying the alleged attackers.
CyberSecurity Help / Benzinga2023-02-22
French national police arrest two brothers aged 18 and 20 in the Ile-de-France region in connection with the February exploit.
CoinDesk2023-02-23
Platypus Finance announces compensation plan guaranteeing minimum 63% reimbursement for affected users, potentially rising to 78%.
CoinDesk2023-03-01
Platypus Finance launches compensation portal for users affected by the February exploit.
DeFi Planet2023-07-12
Second exploit: attacker exploits hardcoded 1:1 USDC/USDT price assumption, draining approximately $50,000–51,000. Pools again paused.
Web3 Is Going Great / BlockSec2023-10-12
Third exploit: three flash loan attacks manipulate cash/liability variables in sAVAX-AVAX pool, draining approximately $2.2 million in sAVAX and WAVAX.
The Block / Halborn2023-10-17
Platypus Finance announces recovery of approximately 90% of October exploit funds following negotiations with attacker; net loss reduced to ~18,000 AVAX (~$167,400). Protocol declines to pursue legal action.
Crypto Times2023-12-04
Paris court acquits both defendants (Mohammed M. and Benamar M.) on all criminal charges. Court rules that exploiting a public smart contract does not constitute unauthorized computer access or fraud under French law.
CoinDesk / The BlockDecision Log
- hash: 4GeaFkvcudkBb2WXch2QdvhiQJ1CLX8wv6yibU94VLgv
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:44 AM
last updated: 5/28/2026, 4:12:58 PM
avoid.net — verified advice for a post-truth world