Platypus Finance
An Avalanche stablecoin protocol exploited for about $8.5M in February 2023 via a flash loan that abused a flawed solvency check. Two brothers were arrested in France (aided by ZachXBT) but were later acquitted of criminal charges by a French court.
Also known as: Platypus Finance, USP
Summary
Platypus Finance was an automated market maker on Avalanche. On February 16–17, 2023, an attacker took a ~$44 million flash loan from Aave, supplied it to a Platypus pool, minted its USP stablecoin against the position, and then used an "emergencyWithdraw" function that a flawed solvency check failed to block — keeping the minted USP and swapping it for about $8.5 million. The exploit de-pegged USP. [1][2]
Arrests and acquittal
With help from investigator ZachXBT and Binance, French police arrested two brothers (Mohammed and Benamar M.) within about a week, and some funds were recovered or frozen. In December 2023, a French court acquitted them of criminal charges, ruling that interacting with a publicly accessible smart contract was not unauthorized computer access and that using the flawed function did not meet the legal threshold for fraud; the defendants had argued they were "ethical hackers." [1][2]
Bracketed numbers refer to the numbered sources listed below.
Sources (2)
See also
World Liberty Financial (WLFI) — Justin Sun token freezeProjectsWLFI, a DeFi project linked to Donald Trump and his family, blacklisted/froze the wallet of major investor Justin Sun in Sept 2025 — ~540–595M unlocked WLFI tokens (~$107M) plus ~2.4B locked. Sun sued, alleging an undisclosed admin 'blacklist backdoor'; WLFI denied it and threatened a countersuit. The dispute is ongoing.
Gala Games exploitTokensOn May 20, 2024 an attacker abused a privileged minter account on the GALA token contract to mint 5 billion GALA (≈$200M+ nominal) and dumped ~600M of them for ~$22M of ETH before Gala froze the address. Gala Games called it an internal access-control failure; the attacker later returned the ~$22M.
This page was last updated on Jun 15, 2026. View revision history.
