Investigation identifying the attacker behind the $9M Platypus Finance flash-loan exploit within a day, followed by the arrest of two suspects in France.
Platypus Finance, an Avalanche stablecoin protocol, was hit with a $9 million flash-loan exploit. Within about a day, the investigation had identified the likely attacker: the exploiter's funding trail led back through an exchange deposit tied to an identifiable account, one of the fastest public attributions of a DeFi exploit to date.
The findings were shared with the protocol team. Days later, two suspects were arrested in France, a result publicly announced at the time.
The case became an early proof point for a model that has since repeated many times: a public exploit, an open-source attribution within days, and arrests shortly after. Much of the stolen value was also stuck in the exploit contract itself, limiting the attacker's actual take.
February 16, 2023
Platypus Finance is exploited for $9M via a flash-loan attack on its stablecoin pools.
February 17, 2023+1 day
Investigation published identifying the likely attacker through their exchange funding trail.
February 24, 2023+7 days
Two suspects are arrested in France; the arrests are publicly announced.
