Platypus Finance
An Avalanche stablecoin protocol exploited for about $8.5M in February 2023 via a flash loan that abused a flawed solvency check. Two brothers were arrested in France (aided by ZachXBT) but were later acquitted of criminal charges by a French court.
Also known as: Platypus Finance, USP
Summary
Platypus Finance was an automated market maker on Avalanche. On February 16–17, 2023, an attacker took a ~$44 million flash loan from Aave, supplied it to a Platypus pool, minted its USP stablecoin against the position, and then used an "emergencyWithdraw" function that a flawed solvency check failed to block — keeping the minted USP and swapping it for about $8.5 million. The exploit de-pegged USP. [1][2]
Arrests and acquittal
With help from investigator ZachXBT and Binance, French police arrested two brothers (Mohammed and Benamar M.) within about a week, and some funds were recovered or frozen. In December 2023, a French court acquitted them of criminal charges, ruling that interacting with a publicly accessible smart contract was not unauthorized computer access and that using the flawed function did not meet the legal threshold for fraud; the defendants had argued they were "ethical hackers." [1][2]
Bracketed numbers refer to the numbered sources listed below.
People & entities involved
Sources (2)
See also
- Loci (LOCIcoin)TokensA 2017–2018 ICO for 'LOCIcoin' tied to the InnVenn IP-search platform. The SEC charged Loci and CEO John Wise with fraud for raising $7.6M on false claims about revenue, headcount, and user base; Wise also misused investor funds. Settled with a $7.6M penalty and an officer/director bar.
- Blockchain Terminal (BCT)TokensA 2017–2018 ICO (BCT tokens, ~$30M) for a 'Blockchain Terminal' — a Bloomberg-style crypto trading terminal. The SEC and DOJ said convicted ex-hedge-funder Boaz Manor secretly ran it under a fake identity ('Shaun MacDonald'), using associate Edith Pardo as a front, and lied about the product's adoption.
- Crowd Machine (CMCT)Tokens
This page was last updated on Jun 8, 2026. View revision history.