DeFi Protocol Platypus Finance Loses Over $2 Million In Another Flash Loan Attack: Report

Decentralized finance (DeFi) protocol Platypus Finance has experienced yet another flash loan exploit, resulting in over $2 million in losses.

Blockchain security firm PeckShield was the first to alert the community about the attack on October 12, shortly after the platform announced it had temporarily suspended all pools. On-chain data also suggests that criminals are specifically targeting the AVAX-sAVAX liquid pool.

According to CertiK's investigation, two malicious entities stole approximately $1.3 million worth of staked AVAX (WAVAX) and approximately $913,000 worth of liquid-staked AVAX (sAVAX). The DeFi protocol said it has launched an investigation into the matter to release a post-mortem report and confirm the amount of stolen digital assets.

“Due to suspicious activity within our protocol, we have taken the step of temporarily banning all pools. Further updates will be communicated to the community in due course. Thank you for your patience and understanding during this time.”

Platypus is an Automated Market Maker (AMM) protocol running on the Avalanche blockchain designed primarily for stablecoin exchanges. In the year In 2021, the platform received $3.3 million in funding in a round led by Three Arrows Capital, which has since announced its lawsuit. This is not the first time the protocol has fallen victim to a flash credit attack. In February, Platypus Finance suffered a heavy loss of more than $8.5 million. In this case, the attackers exploited a vulnerability in Platypus Finance's native stablecoin USP solvency check mechanism, tricking smart contracts into thinking the USP was fully funded. In September, the team behind the DeFi protocol successfully recovered approximately 61.7% of the initial losses of their liquidity pools during the USP exploit. To make up for it further, they entered the occupied treasury and began a second phase of recovery on September 26.