Court drops criminal charges against Platypus Finance hacker

A French court dropped criminal charges against those involved in the hack of the DeFi protocol Platypus Finance, linked to $8.5 million in February 2023. The report is by Le Monde.

The attackers, named in the report as brothers Mohamed and Benamar M., were detained a few days after the attack. Identification was helped by information from Binance and the on-chain sleuth ZachXBT.

Mohamed faced multiple charges, including unauthorized access to an automated data-processing system, fraud and money laundering. He faced up to five years in prison. The allegations against his brother related to the receipt of stolen funds.

At the October 26 hearing, Mohamed did not dispute the facts. However, he stated that he acted in good faith and was an ‘ethical hacker’. His stated aim, allegedly, was ‘to recover funds on the Platypus platform that were at risk of vanishing, to be returned later.’ He said he expected a 10% bonus on the amount.

Mohamed also claimed that he used for the attack an “instant loan” by exploiting a vulnerability discovered by chance in the protocol, studying how it works.

The court held that the charges of unauthorized access to computer systems could not apply to his actions, as this concerned a publicly accessible smart contract.

The court also found that the Platypus exploit was not fraud. Accordingly, the charges against the brothers for money laundering and receiving stolen funds were dropped.

However, the court reminded them that the DeFi project could file a civil suit against them.

During the attack, Mohamed inadvertently blocked tokens worth millions of dollars and was able to cash out only about ~$270,000.

@Platypusdefi was exploited resulting in a total loss of ~$9.05M. Although the project suffered significant losses from the three attacks, the attacker was only able to control a total of ~$270K from the third attack. The exploiter’s initial fund came from @FixedFloat

After… https://t.co/ckq4XWPexg

— MetaSleuth (@MetaSleuth) February 17, 2023

Platypus also managed to recover assets worth about $2 million with the help of BlockSec specialists.

In October, the protocol built on Avalanche was attacked again. Losses amounted to about $2 million. The hacker used the instant-loan exploit. The attacker returned 90% of the stolen funds to Platypus in exchange for roughly 18,000 AVAX (~$164,700 at the time).

In November, the year’s record losses from hacks and fraud stood at $343 million, according to Immunefi.