Platypus Finance protocol hacked for $2 million

The DeFi project Platypus Finance on the Avalanche network was the victim of an attack, losing around $2 million in digital assets. PeckShield analysts were the first to notice this.

Update: total loss >$2m pic.twitter.com/JnJQjn4Aik

— PeckShieldAlert (@PeckShieldAlert) October 12, 2023

Following the report of the hack, the project temporarily halted all liquidity pools due to suspicious activity.

Due to suspicious activities in our protocol, we have taken the proactive measure of temporarily suspending all pools.
Further updates will be communicated to the community in a timely manner.
Thank you for your patience and understanding during this time.

— Platypus ? (?+?+?) (@Platypusdefi) October 12, 2023

Likely, the attacker exploited a flash-loan vulnerability targeting AVAX-sAVAX pools. No official comments on the vulnerability have been released yet.

Platypus had previously been subjected to an attack in February this year, resulting in assets worth $8.5 million being withdrawn. Additionally, the project’s stablecoin USP lost its dollar peg following the breach.

The team said the hacker used a flash loan and a logical error in the solvency-check mechanism in the collateral contract. Later, the French police detained suspects in the attack.

Funds in the main Platypus pool covered about 35% of user deposits. The developers are still paying compensation for the lost peg of the stablecoin. In total, they have returned around $1.3 million.

Update on USP compensation
1/ We used the reserved treasury for the 2nd round of compensation today.
Please note that volatile asset values have fluctuated since the plan’s inception, resulting in a total refund of around 1.3m.
Compensation Page: https://t.co/LYUuUsKR8b

— Platypus ? (?+?+?) (@Platypusdefi) September 26, 2023

According to Immunefi, in the third quarter losses to the industry from hacks and frauds reached $685.5 million — 59.9% higher than the same period last year.

In October, the Web3-application Stars Arena on the Avalanche network lost 266,103 AVAX (~$3 million at the time of the attack) due to a serious security breach in the smart contracts.