Platypus Protocol Loses $8.5M in Flash Loan Attack

Platypus, a decentralized finance (DeFi) protocol, was the victim of a flash loan attack worth $8.5 million. The stablecoin USP got depegged by 50% before recovering the peg.

The DeFi protocol Aave developed flash loans in 2020, which made lending and borrowing simpler without collateral. In layman’s language, a crypto loan is taken out and repaid within the same transaction in a flash loan. But, this facility attracted bad actors to take huge loans and then use the amount to manipulate the market in their favor. Such malicious activity is referred to as a flash-loan attack

The DeFi protocol, Platypus, became the latest victim of the flash loan attack, which saw the hacker drain approximately $8.5 million.

Dear Community,
We regret to inform you that our protocol was hacked recently, and the attacker took advantage of a flaw in our USP solvency check mechanism. They used a flashloan to exploit a logic error in the USP solvency check mechanism in the contract holding the collateral.
— Platypus 🔺 (🦆+🦦+🦫) (@Platypusdefi) February 17, 2023

Team Works on Recovery Plan

Platypus Finance is a stablecoin swap on the Avalanche blockchain. Recently, it launched its stablecoin USP on Feb. 6. The attackers conducted a flash loan attack by exploiting a logic error in the USP solvency check mechanism.

After the attack, the USP lost its peg and was trading at around $0.47, but now the stablecoin has almost recovered its peg.

Platypus USD chart from CoinGecko — Source: CoinGecko

The team is working with Binance, Tether, and Circle to freeze the fund. They have successfully managed to freeze the USDT. The protocol has also paused all the withdrawals for the time being.

According to the latest Discord message from the admin, the team will soon release a “full recovery and action plan.”

ZachXBT Tracks Down Identity of Attacker

The on-chain sleuth ZachXBT traced down the wallet addresses of the attacker to a Twitter account, “retlqw.” He reached out to the potential attacker to negotiate the return of the fund, but the person deactivated their Twitter and Instagram accounts.

I’ve reviewed your transaction history across multiple chains which lead me to your ENS address retlqw.eth
Your OpenSea account links directly to your Twitter and you liked a Tweet about the Platypus exploit. pic.twitter.com/ojgNBwKc2K
— ZachXBT (@zachxbt) February 17, 2023

As the team froze a significant portion of the fund, the community believes that the hacker does not have a chance of negotiating a bounty negotiation.

Got something to say about Platypus or anything else? Write to us or join the discussion on our Telegram channel. You can also catch us on TikTok, Facebook, or Twitter.

For BeInCrypto’s latest Bitcoin (BTC) analysis, click here.

Disclaimer

BeInCrypto has reached out to company or individual involved in the story to get an official statement about the recent developments, but it has yet to hear back.

Source: https://beincrypto.com/platypus-loses-8-5m-flash-loan-attack/