How much was lost in the Platypus Finance hack?

$8.5M Flash Loan Attack, as publicly reported (February 16, 2023).

Who was behind the Platypus Finance hack?

Publicly attributed to Individual hackers (arrested). ChainHint does not attribute the attacker independently — it traces the funds from the address on the public record and reports where they went.

Case Studies/Platypus Finance

Platypus Finance Hack: $8.5M Flash Loan Attack

Q: How was the Platypus Finance hack carried out?

Flash Loan Strike. Flash-loaned USDC deposited as collateral to mint USP stablecoin; a missing solvency check in the emergency-withdraw path let the attacker pull collateral without repaying the minted debt — draining $8.5M in one sequence.

February 16, 2023 · Avalanche · Individual hackers (arrested)

stolen

$8.5M

arrests

What happened

On February 16, 2023, Platypus Finance — a stableswap AMM on Avalanche — was exploited for $8.5M via a flash loan attack on its USP stablecoin. The attacker used flash-loaned USDC as collateral to mint USP, then abused a missing solvency check in the protocol's emergency withdrawal path to reclaim the collateral while keeping the minted debt outstanding. The aftermath was unusually favorable for victims: a significant portion of the stolen stablecoins was frozen or recovered with help from security researchers and stablecoin issuers, and within days French police arrested two suspects identified through on-chain analysis. The freezes cut the laundering routes short before much of the loot could move. A graph was re-traced onto this row on October 8, 2026, but its earliest traced movement falls months after the exploit rather than in the days around it, and nobody has yet established what it followed — so ChainHint states no count, no endpoint and no destination from it here.

How the funds moved

Step 1

Flash Loan Strike

Flash-loaned USDC deposited as collateral to mint USP stablecoin; a missing solvency check in the emergency-withdraw path let the attacker pull collateral without repaying the minted debt — draining $8.5M in one sequence.

Step 2

Stalled Laundering

The attacker tried to move the proceeds on, but stablecoin freezes and a partially stuck exploit contract trapped much of the loot before it could exit.

Step 3

Freezes & Arrests

Security researchers and stablecoin issuers froze or clawed back a large share of the funds. On-chain attribution led French police to arrest two suspects within days — one of the fastest hack-to-arrest timelines in DeFi.

Visualized attack path

View Interactive Graph →

Key findings

Source Wallet

0xc64a…521aPlatypus Exploiter — executed the flash loan attack and received the drained stablecoins

ExploiterFlash Loan

Root Cause

Emergency withdrawal — missing solvency checkThe emergency-withdraw path released collateral without verifying outstanding USP debt, letting the attacker exit with both the collateral and the minted stablecoins.

Logic Bug

Recovery

Majority frozen or recoveredStablecoin issuer freezes and a partially stuck exploit contract prevented most of the $8.5M from being laundered; a large share was returned to the protocol.

Partial Recovery

Attribution

2 suspects arrested in FranceOn-chain analysis identified the attackers; French police made two arrests within days of the exploit.

Arrested

Investigate your own incident

ChainHint traced the Platypus Finance hack in minutes.
Use the same tool for your case.