DeFi Protocol Platypus Finance Loses Over $2M in Another Flash Loan Attack: Report

Decentralized finance (DeFi) protocol Platypus Finance has suffered yet another flash loan exploit that resulted in the loss of over $2 million.

Blockchain security firm PeckShield was the first to alert the community about the hack on October 12th, shortly after which the platform announced temporarily suspending all pools. On-chain data also suggest that the perpetrators specifically target the AVAX-sAVAX liquidity pool.

According to CertiK’s investigation, two malicious entities stole approximately $1.3 million worth of wrapped AVAX (WAVAX) and around $913,000 in liquid-staked AVAX (sAVAX).
The DeFi protocol is yet to release a post-mortem report and verify the amount of digital assets stolen but has revealed initiating an investigation into the matter.

“Due to suspicious activities in our protocol, we have taken the proactive measure of temporarily suspending all pools. Further updates will be communicated to the community in a timely manner. Thank you for your patience and understanding during this time.”

Platypus is an Automated Market Maker (AMM) protocol that operates on the Avalanche blockchain, primarily designed for the exchange of stablecoins.
The platform secured $3.3 million in funding during a round spearheaded by Three Arrows Capital in 2021, which has since declared bankruptcy.
This isn’t the first time the protocol fell victim to a flash loan attack. In February, Platypus Finance experienced a devastating loss of more than $8.5 million.
During this incident, the attackers exploited a vulnerability within Platypus Finance’s native stablecoin’s USP solvency check mechanism, deceiving the smart contracts into believing that USP was fully backed.
By September, the team behind the DeFi protocol had successfully recovered approximately 61.7% of the initial losses suffered by their liquidity pools during the USP exploit. To further compensate, they accessed a reserved treasury and initiated a second phase of recovery on September 26.