Platypus Finance Unchecked Stablecoin Collateral - Revision history

Azoundria: Another 30 minutes complete.

2023-06-18T20:45:48Z

Another 30 minutes complete.

@@ Line 120: / Line 120: @@
 |March 3rd, 2023 1:35:00 AM MST
 |Compensation Page Updated
-|Platypus Finance announces that they "have updated [thei]r compensation page". "If you have deposited or withdrawn LP tokens from our yield aggregators before the pool pause, your compensation amount will be updated accordingly"<ref>[https://twitter.com/Platypusdefi/status/1631573948147306497 Platypus Finance - "We have updated our compensation page today! If you have deposited or withdrawn LP tokens from our yield aggregators before the pool pause, your compensation amount will be updated accordingly." - Twitter] (Jun 17, 2023)</ref>.
+|Platypus Finance announces that they "have updated [thei]r compensation page". "If you have deposited or withdrawn LP tokens from our yield aggregators before the pool pause, your compensation amount will be updated accordingly"<ref>[https://twitter.com/Platypusdefi/status/1631573948147306497 Platypus Finance - "We have updated our compensation page today! If you have deposited or withdrawn LP tokens from our yield aggregators before the pool pause, your compensation amount will be updated accordingly." - Twitter] (Jun 17, 2023)</ref><ref>[https://twitter.com/Platypusdefi/status/1631573956049399809 Platypus Finance - "As a reminder, the compensation will be made in March, and the exact date depends on the finalized calculation. We have reviewed most of the users' submissions regarding our calculation, and we will DM you to share an update on the calculation of your case." - Twitter] (Jun 18, 2023)</ref>.
 |-
 |March 10th, 2023 4:12:00 AM MST
@@ Line 141: / Line 149: @@
 |Vector Finance Funds Transfered
 |Vector Finance reports that they've received their share of the recovered funds from Platypus Finance<ref name=":23">[https://twitter.com/vector_fi/status/1634339434073296897 Platypus Finance - "Great news! @Platypusdefi has transferred our share of the recovered funds. We're building out a page where users can see what they are owed. That page will be available early next week. Affected users will be able to claim their share soon afterward. More to come!" - Twitter] (Jun 15, 2023)</ref>.
 |-
 |March 13th, 2023 4:06:00 AM MDT
@@ Line 153: / Line 169: @@
 |Claims Now Possible Through Pool Page
 |Platypus Finance announces that users who have unclaimed rewards from the old main pool now have the ability to easily claim them on the pool page. By navigating to the Pool page, users will find their unclaimed rewards in the section labeled "main pool (deprecated)". This provides a straightforward process for users to access and claim their outstanding rewards from the previous main pool<ref>[https://twitter.com/Platypusdefi/status/1635586000478150657 Platypus Finance - "If you have any unclaimed rewards from the old main pool, you can now easily claim them on the pool page." - Twitter] (Jun 13, 2023)</ref>.
 |-
 |March 14th, 2023 7:29:00 AM MDT
@@ Line 429: / Line 449: @@
 We're in the process of setting up a bounty & encourage the hacker to reach out to us. We also welcome anyone with useful information to come forward to us."
 == Total Amount Recovered ==
-There do not appear to have been any funds recovered in this case.
+Funds were partially recovered through a series of actions undertaken:
-What funds were recovered? What funds were reimbursed for those affected users?
+* A reverse hack on the liquidity pool which the attackers set up, to take back the funds.
 == Ongoing Developments ==
-What parts of this case are still remaining to be concluded?
+The Platypus Finance protocol continues to operate.
 == Individual Prevention Policies ==
 {{Prevention:Individual:Avoid Using Smart Contracts}}
@@ Line 444: / Line 490: @@
 == Platform Prevention Policies ==
 {{Prevention:Platforms:Regular Audit Procedures}}
 {{Prevention:Platforms:End}}

Azoundria: Another 30 minutes complete.

2023-06-17T23:30:06Z

Another 30 minutes complete.

@@ Line 77: / Line 77: @@
 |Platypus Finance shared a further update with their community on February 23rd<ref name=":10">[https://twitter.com/Platypusdefi/status/1628759079928856576 Platypus Finance - "Since the attack, we've been working with security experts & stakeholders to recover lost funds, trace the hacker, and explore potential solutions to retrieve trapped funds." - Twitter] (Jun 3, 2023)</ref>. TBD more details.
 |-
+|February 25th, 2023 4:48:00 AM MST
 |Exploiters Arrested By French Police
-|This is shared by Zachxbt<ref>[https://twitter.com/zachxbt/status/1629449408289832960 Zachxbt - "Update: Suspects caught by French law enforcement" - Twitter] (May 30, 2023)</ref>.
+|"@PoliceNationale have arrested and summoned 2 suspects who were reportedly exploiting our platform."<ref>[https://twitter.com/Platypusdefi/status/1629448306186412033 Platypus Finance - "@PoliceNationale have arrested and summoned 2 suspects who were reportedly exploiting our platform. Thanks to the assistance of @binance  and @zachxbt in tracing their identities. Kudos to the prompt action by the authorities!" - Twitter] (Jun 17, 2023)</ref> This is shared by Zachxbt<ref>[https://twitter.com/zachxbt/status/1629449408289832960 Zachxbt - "Update: Suspects caught by French law enforcement" - Twitter] (May 30, 2023)</ref>.
 |-
 |March 10th, 2023 4:12:00 AM MST

Azoundria: Another 30 minutes complete.

2023-06-16T06:36:07Z

Another 30 minutes complete.

@@ Line 80: / Line 80: @@
 |Exploiters Arrested By French Police
 |This is shared by Zachxbt<ref>[https://twitter.com/zachxbt/status/1629449408289832960 Zachxbt - "Update: Suspects caught by French law enforcement" - Twitter] (May 30, 2023)</ref>.
 |-
 |March 13th, 2023 5:34:00 AM MDT
@@ Line 215: / Line 239: @@
 We have also been working with different parties to recover the damage but we would need more time to confirm the result. Legal enforcement is something we’re also working on, we’ll make further announcement once these are confirmed.</blockquote>
 === Aave Fund Recovery ===
-<ref name=":16" /><ref name=":17" /><blockquote>Greetings @AaveAave  community!
+<ref name=":21" />.<blockquote>Dear @AaveAave community,
 We would appreciate your support in helping us recover lost funds for our LP by voting in favor of our proposal before the voting deadline of March 14, 2023, at 8 PM UTC.

Azoundria: Another 30 minutes complete.

2023-06-14T02:17:52Z

Another 30 minutes complete.

@@ Line 80: / Line 80: @@
 |Exploiters Arrested By French Police
 |This is shared by Zachxbt<ref>[https://twitter.com/zachxbt/status/1629449408289832960 Zachxbt - "Update: Suspects caught by French law enforcement" - Twitter] (May 30, 2023)</ref>.
 |-
 |March 31st, 2023 8:08:00 AM MDT
 |Platypus Finance Update Posted
-|<ref name=":11">[https://twitter.com/Platypusdefi/status/1641804576176369665 Platypus Finance - We appreciate your continued support and trust in our team as we navigate through this challenging situation. We will keep you updated on our progress towards fund recovery and the development of Platypus as a fully decentralized protocol!" - Twitter] (Jun 10, 2023)</ref>
+|Platypus, provided an update on recent developments and future plans<ref name=":20">[https://twitter.com/Platypusdefi/status/1641804554454077440 Platypus Finance - "It is with great pleasure that we provide the recent updates of Platypus and our plan for the upcoming months." - Twitter] (Jun 13, 2023)</ref>. They report successfully rescuing $380k worth of funds trapped in the Aave contract and are arranging a second compensation round to prevent legal conflicts. Efforts are being made to recover unrecovered funds through negotiations with related parties. In terms of upcoming plans, Platypus aims to become a fully decentralized protocol in Q2 and will launch a discussion forum for the community, introducing off-chain voting for vePTP holders. They emphasize the importance of community participation and believe it will contribute to the success and growth of Platypus<ref name=":11">[https://twitter.com/Platypusdefi/status/1641804576176369665 Platypus Finance - We appreciate your continued support and trust in our team as we navigate through this challenging situation. We will keep you updated on our progress towards fund recovery and the development of Platypus as a fully decentralized protocol!" - Twitter] (Jun 10, 2023)</ref>.
 |-
 |April 1st, 2023 9:08:00 AM MDT
@@ Line 192: / Line 216: @@
 We have also been working with different parties to recover the damage but we would need more time to confirm the result. Legal enforcement is something we’re also working on, we’ll make further announcement once these are confirmed.</blockquote>
-=== Aave Governance Proposal ===
+=== Aave Fund Recovery ===
 Part of the recovery came from an Aave governance proposal which was submitted to the smart contract's governance<ref name=":8" /><ref name=":9" />.<blockquote>Update: We have submitted a post on the @AaveAave governance forum to gather feedback from the community on the recovery of the exploited assets that are stuck in the Aave v3 contract.
@@ Line 227: / Line 265: @@
 Thank you for your ongoing support & patience during this difficult time.</blockquote>
 === March 31st Update ===
-The Platypus Finance team provides a further update to their community to announce that $380k worth of funds trapped in the Aave smart contract were rescued <ref name=":11" />. TBD more detail filling in.<blockquote>It is with great pleasure that we provide the recent updates of Platypus and our plan for the upcoming months.
+The Platypus Finance team provides a further update<ref name=":20" /> to their community to announce that $380k worth of funds trapped in the Aave smart contract were rescued<ref name=":11" />. They are arranging a second compensation round to prevent legal conflicts. Efforts are being made to recover unrecovered funds through negotiations with related parties. In terms of upcoming plans, Platypus aims to become a fully decentralized protocol in Q2 and will launch a discussion forum for the community, introducing off-chain voting for vePTP holders. They emphasize the importance of community participation and believe it will contribute to the success and growth of Platypus.<blockquote>It is with great pleasure that we provide the recent updates of Platypus and our plan for the upcoming months.
 Recent update 1: 380k worth of funds that trapped in the Aave contract were previously rescued. We've consulted our legal partner to ensure that we follow the appropriate procedures & will arrange for a 2nd compensation round later to prevent any potential legal conflicts.

Azoundria: Another 30 minutes complete.

2023-06-10T17:57:15Z

Another 30 minutes complete.

@@ Line 80: / Line 80: @@
 |Exploiters Arrested By French Police
 |This is shared by Zachxbt<ref>[https://twitter.com/zachxbt/status/1629449408289832960 Zachxbt - "Update: Suspects caught by French law enforcement" - Twitter] (May 30, 2023)</ref>.
 |}
@@ Line 212: / Line 228: @@
 Thank you for your ongoing support & patience during this difficult time.</blockquote>
 What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Azoundria: Another 30 minutes complete.

2023-06-04T03:39:10Z

Another 30 minutes complete.

Show changes

Azoundria: Another 30 minutes complete.

2023-05-31T18:33:31Z

Another 30 minutes complete.

@@ Line 52: / Line 52: @@
 |Funds Recovered From Smart Contract
 |This is crossposted by Zachxbt<ref>[https://twitter.com/zachxbt/status/1626643294175232000 Zachxbt - "Update: Some of the funds were recovered from the contract." - Twitter] (May 30, 2023)</ref>.
 |-
 |February 17th, 2023 9:40:00 AM MST
 |RektHQ Article
 |The situation gets an honourable mention on the RektHQ aggregator<ref>[https://twitter.com/RektHQ/status/1626622511873155072 RektHQ - "@Platypusdefi lost $8.5M to a flash loan attack on its new stablecoin." - Twitter] (May 3, 2023)</ref>. They report that the platform lost $8.5 million to a flash loan attack on its recently launched stablecoin, USP. The attack occurred just 10 days after the launch and resulted in USP being heavily undercollateralized. The attacker exploited a flaw in Platypus’ USP solvency check mechanism, withdrawing collateral while keeping the borrowed USP. The attack drained the liquidity of other stables, leaving USP depegged by over 50%. The attacker’s address and ENS address were identified by Platypus users, and the team has appealed to the attacker to come forward. This incident highlights the importance of robust security measures in DeFi protocols<ref name="rektnews-10861" />.
 |-
+|
@@ Line 110: / Line 122: @@
 We’d like to negotiate returning of the funds before we engage with law enforcement.</blockquote>
 == Ultimate Outcome ==
 What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Azoundria: Another 30 minutes complete.

2023-05-31T03:46:40Z

Another 30 minutes complete.

← Older revision		Revision as of 21:46, 30 May 2023
Line 1:		Line 1:
	{{~~Imported~~ Case Study~~\|source=https://www.quadrigainitiative.com/casestudy/platypusfinanceuncheckedstablecoincollateral.php~~}}[[File:Platypusfinance.jpg\|thumb\|Platypus Finance]]Platypus has introduced a new kind of AMM for stableswap that manages risk autonomously based on the coverage ratio. The new design is intended to solve the problem of liquidity fragmentation and to simplify pool compositions, leading to a better user experience. Platypus recently launched its own stablecoin, USP, but the mechanism was attacked, depegging USP and leaving it heavily undercollateralized. The hack was due to a flaw in USP's solvency check mechanism that allowed the attacker to withdraw the supplied collateral while keeping the borrowed USP. The stolen $8.5M remain in the hacker's contract, of which, $1.5M of stolen USDT has been blacklisted. The culprit has been identified, and the Platypus team is setting up a bounty and encouraging the hacker to reach out to them.		{{Case Study Under Construction}}[[File:Platypusfinance.jpg\|thumb\|Platypus Finance]]Platypus has introduced a new kind of AMM for stableswap that manages risk autonomously based on the coverage ratio. The new design is intended to solve the problem of liquidity fragmentation and to simplify pool compositions, leading to a better user experience. Platypus recently launched its own stablecoin, USP, but the mechanism was attacked, depegging USP and leaving it heavily undercollateralized. The hack was due to a flaw in USP's solvency check mechanism that allowed the attacker to withdraw the supplied collateral while keeping the borrowed USP. The stolen $8.5M remain in the hacker's contract, of which, $1.5M of stolen USDT has been blacklisted. The culprit has been identified, and the Platypus team is setting up a bounty and encouraging the hacker to reach out to them.

	== About Platypus Finance ==		== About Platypus Finance ==
Line 40:		Line 40:
	\|Platypus Finance Announcement		\|Platypus Finance Announcement
	\|Platypus Finance posts an announcement on their Twitter about the exploit. They report that the attacker exploited a flaw in the USP solvency check mechanism, using a flashloan to take advantage of a logic error in the contract holding the collateral, resulting in a loss of 8.5 million dollars from their main pool. Platypus Finance has reached out to the hacker to negotiate a bounty in exchange for the return of the funds, and is currently working with Binance, Tether, and Circle to freeze the hacker's funds and prevent further losses. The protocol is covering 35% of user deposits, and the funds in the other pool are unaffected. Platypus Finance is also exploring options for compensation and reimbursement for affected investors. The community has been reassured that the matter is being treated with utmost seriousness and that they will be updated on any progress<ref name="platypusdefitwitter-10862" />.		\|Platypus Finance posts an announcement on their Twitter about the exploit. They report that the attacker exploited a flaw in the USP solvency check mechanism, using a flashloan to take advantage of a logic error in the contract holding the collateral, resulting in a loss of 8.5 million dollars from their main pool. Platypus Finance has reached out to the hacker to negotiate a bounty in exchange for the return of the funds, and is currently working with Binance, Tether, and Circle to freeze the hacker's funds and prevent further losses. The protocol is covering 35% of user deposits, and the funds in the other pool are unaffected. Platypus Finance is also exploring options for compensation and reimbursement for affected investors. The community has been reassured that the matter is being treated with utmost seriousness and that they will be updated on any progress<ref name="platypusdefitwitter-10862" />.
			\|-
			\|February 16th, 2023 9:12:00 PM MST
			\|ZachXbt Calls Out The Attacker
			\|ZachXbt traces the attack to Twitter user retlqw, and calls them out publicly after they deactivate their account<ref name=":0">[https://twitter.com/zachxbt/status/1626434265260118021 zachxbt - "Hi @retlqw since you deactivated your account after I messaged you. I've traced addresses back to your account from the @Platypusdefi exploit and I am in touch with their team and exchanges. We’d like to negotiate returning of the funds before we engage with law enforcement." - Twitter] (May 30, 2023)</ref>.
			\|-
			\|February 16th, 2023 9:28:00 PM MST
			\|Attacker Deletes Instagram
			\|The reported attacker has apparently deleted their Instagram account<ref>[https://twitter.com/zachxbt/status/1626438474407546880 ZachXbt - "You Deactivated your Instagram too?" - Twitter] (May 30, 2023)</ref>.
			\|-
			\|
			\|Funds Recovered From Smart Contract
			\|This is crossposted by Zachxbt<ref>[https://twitter.com/zachxbt/status/1626643294175232000 Zachxbt - "Update: Some of the funds were recovered from the contract." - Twitter] (May 30, 2023)</ref>.
	\|-		\|-
	\|February 17th, 2023 9:40:00 AM MST		\|February 17th, 2023 9:40:00 AM MST
	\|RektHQ Article		\|RektHQ Article
	\|The situation gets an honourable mention on the RektHQ aggregator<ref>[https://twitter.com/RektHQ/status/1626622511873155072 RektHQ - "@Platypusdefi lost $8.5M to a flash loan attack on its new stablecoin." - Twitter] (May 3, 2023)</ref>. They report that the platform lost $8.5 million to a flash loan attack on its recently launched stablecoin, USP. The attack occurred just 10 days after the launch and resulted in USP being heavily undercollateralized. The attacker exploited a flaw in Platypus’ USP solvency check mechanism, withdrawing collateral while keeping the borrowed USP. The attack drained the liquidity of other stables, leaving USP depegged by over 50%. The attacker’s address and ENS address were identified by Platypus users, and the team has appealed to the attacker to come forward. This incident highlights the importance of robust security measures in DeFi protocols<ref name="rektnews-10861" />.		\|The situation gets an honourable mention on the RektHQ aggregator<ref>[https://twitter.com/RektHQ/status/1626622511873155072 RektHQ - "@Platypusdefi lost $8.5M to a flash loan attack on its new stablecoin." - Twitter] (May 3, 2023)</ref>. They report that the platform lost $8.5 million to a flash loan attack on its recently launched stablecoin, USP. The attack occurred just 10 days after the launch and resulted in USP being heavily undercollateralized. The attacker exploited a flaw in Platypus’ USP solvency check mechanism, withdrawing collateral while keeping the borrowed USP. The attack drained the liquidity of other stables, leaving USP depegged by over 50%. The attacker’s address and ENS address were identified by Platypus users, and the team has appealed to the attacker to come forward. This incident highlights the importance of robust security measures in DeFi protocols<ref name="rektnews-10861" />.
			\|-
			\|
			\|Exploiters Arrested By French Police
			\|This is shared by Zachxbt<ref>[https://twitter.com/zachxbt/status/1629449408289832960 Zachxbt - "Update: Suspects caught by French law enforcement" - Twitter] (May 30, 2023)</ref>.
	\|}		\|}

Line 87:		Line 103:

	6/ We understand that this is a difficult time for our community, and we appreciate your patience and understanding. We want to assure you that we are taking this matter seriously and will keep you informed as we make progress. Thank you for your continued support.</blockquote>		6/ We understand that this is a difficult time for our community, and we appreciate your patience and understanding. We want to assure you that we are taking this matter seriously and will keep you informed as we make progress. Thank you for your continued support.</blockquote>

			=== ZachXbt Tracing The Funds ===
			ZachXbt reportedly traced the funds to Twitter user retlqw<ref name=":0" />.<blockquote>Hi @retlqw since you deactivated your account after I messaged you.

			I've traced addresses back to your account from the @Platypusdefi exploit and I am in touch with their team and exchanges.

			We’d like to negotiate returning of the funds before we engage with law enforcement.</blockquote>

	== Ultimate Outcome ==		== Ultimate Outcome ==
Line 107:		Line 130:
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
	== Individual Prevention Policies ==		== Individual Prevention Policies ==
	{{Prevention:~~Individuals~~:~~Placeholder~~}}		{{Prevention:Individual:Avoid Using Smart Contracts}}

	{{Prevention:Individuals:End}}		{{Prevention:Individuals:End}}

	== Platform Prevention Policies ==		== Platform Prevention Policies ==
	{{Prevention:Platforms:~~Placeholder~~}}		{{Prevention:Platforms:Regular Audit Procedures}}

	{{Prevention:Platforms:End}}		{{Prevention:Platforms:End}}

	== Regulatory Prevention Policies ==		== Regulatory Prevention Policies ==
	{{Prevention:Regulators:~~Placeholder~~}}		{{Prevention:Regulators:Platform Security Assessments}}

	{{Prevention:Regulators:End}}		{{Prevention:Regulators:End}}

Azoundria: Initial 30 minutes. All sources integrated.

2023-05-04T03:55:01Z

Initial 30 minutes. All sources integrated.

Show changes

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/platypusfinanceuncheckedstablecoincollateral.php}} {{Unattributed Sources}} Platypus FinancePlatypus has introduced a new kind of AMM for stableswap that manages risk autonomously based on the coverage ratio. The new design is intended to solve the problem of liquidity fragmentation and to simplify pool compositions, leading to a better user experience. Platypus..."

2023-05-04T03:41:14Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/platypusfinanceuncheckedstablecoincollateral.php}} {{Unattributed Sources}} thumb|Platypus FinancePlatypus has introduced a new kind of AMM for stableswap that manages risk autonomously based on the coverage ratio. The new design is intended to solve the problem of liquidity fragmentation and to simplify pool compositions, leading to a better user experience. Platypus..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/platypusfinanceuncheckedstablecoincollateral.php}}
{{Unattributed Sources}}

[[File:Platypusfinance.jpg|thumb|Platypus Finance]]Platypus has introduced a new kind of AMM for stableswap that manages risk autonomously based on the coverage ratio. The new design is intended to solve the problem of liquidity fragmentation and to simplify pool compositions, leading to a better user experience. Platypus recently launched its own stablecoin, USP, but the mechanism was attacked, depegging USP and leaving it heavily undercollateralized. The hack was due to a flaw in USP's solvency check mechanism that allowed the attacker to withdraw the supplied collateral while keeping the borrowed USP. The stolen $8.5M remain in the hacker's contract, of which, $1.5M of stolen USDT has been blacklisted. The culprit has been identified, and the Platypus team is setting up a bounty and encouraging the hacker to reach out to them.

This is a global/international case not involving a specific country.<ref name="platypusfinance-10860" /><ref name="rektnews-10861" /><ref name="platypusdefitwitter-10862" /><ref name="snowtrace-10863" />

== About Platypus Finance ==
"This Changes Everything. A whole new kind of AMM for stableswap. Lower Slippage. Simpler UX."

"One of the major problems found in the first generation stableswaps’ Closed liquidity pools is liquidity fragmentation, where the liquidity of different pools cannot be shared with one another, resulting in higher slippage."

"The design of other stableswaps requires multiple tokens of equal value within a pool, often complicating its pool compositions (pairing up LP token with new tokens). It significantly hinders the scalability of the protocol and leads to bad user experience."

"Platypus invents a whole new AMM on Avalanche - Open liquidity single-sided AMM managing risk autonomously based on the coverage ratio, allowing maximal capital efficiency."

"The key concept underpinning Platypus’ design is asset liability management (ALM). Platypus is the first of its kind to use a single-variant slippage function instead of invariant curves."

"A highly-specialised creature may be well suited to its own habitat, but Platypus’ attempts to adapt have ended up dead in the water.

Adding to its existing stableswap AMM platform, Platypus recently launched its own stablecoin, USP. However, just 10 days after launch, the new mechanism was attacked, depegging USP and leaving it heavily undercollateralised."

"Dear Community,

We regret to inform you that our protocol was hacked recently, and the attacker took advantage of a flaw in our USP solvency check mechanism. They used a flashloan to exploit a logic error in the USP solvency check mechanism in the contract holding the collateral."

"The attacker first took a flash loan of 44M USDC which was deposited into Platypus. The resulting LP tokens were then used as collateral to borrow 41.7M USP.

The emergencyWithdraw() function only checks whether the user’s position is currently solvent, but neglects to first check against any the effect of any borrowed funds. This allows the attacker to withdraw the supplied collateral while keeping the borrowed USP.

The collateral was then withdrawn to repay the flash loan, and the USP was swapped via Platypus pools, draining the existing liquidity of other stables (USDC, USDT, DAI, BUSD, etc.)."

"The hack has left USP depegged by over 50% as the attacker swapped the USP for other stables. The stolen $8.5M remain in the hacker’s contract, of which, $1.5M of stolen USDT has been blacklisted."

"The rather simple vulnerability, combined with the loot being left (or possibly trapped) as freezable, centralised stables suggests this heist may have been pulled off by a relatively inexperienced amateur."

"After just a few hours, fellow platypus ZachXBT managed to identify the culprit via their ENS address, linked to the exploiter’s transaction history. The same alias was used for now-deleted Twitter and Instagram accounts. The Platypus team have since appealed to the doxxed exploiter:

We're in the process of setting up a bounty & encourage the hacker to reach out to us. We also welcome anyone with useful information to come forward to us."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:
* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Platypus Finance Unchecked Stablecoin Collateral
!Date
!Event
!Description
|-
|February 16th, 2023 12:16:54 PM MST
|Exploit Transaction
|The exploit transaction on the Avalanche blockchain.
|}

== Technical Details ==
This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

== Total Amount Lost ==
The total amount lost has been estimated at $8,500,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="platypusfinance-10860">[https://platypus.finance/ Platypus - A Novel StableSwap: simple, flexible and scalable] (May 3, 2023)</ref>

<ref name="rektnews-10861">[https://rekt.news/platypus-finance-rekt/ Rekt - Platypus Finance - REKT] (May 3, 2023)</ref>

<ref name="platypusdefitwitter-10862">[https://twitter.com/Platypusdefi/status/1626396538611310592 @Platypusdefi Twitter] (May 3, 2023)</ref>

<ref name="snowtrace-10863">[https://snowtrace.io/tx/0x1266a937c2ccd970e5d7929021eed3ec593a95c68a99b4920c2efa226679b430 Avalanche Transaction Hash (Txhash) Details | SnowTrace] (May 3, 2023)</ref></references>