The DeFi software Platypus Finance has suffered a $9 million assault, based on a collection of tweets from the blockchain safety agency CertiK on Feb. 16.
That report states that an attacker used flash loans on the Avalanche (AVAX) blockchain to use a operate in one in all Platypus’ sensible contracts.
The attacker deposited $44 million of stablecoins into the appliance. With the belongings obtained, the attacker might mint the same quantity of Platypus’ USP stablecoin (41.79 million USP). The attacker then exploited an emergency withdrawal operate to entry the unique $44 million deposit and the minted USP. Lastly, the attacker swapped the USP for different belongings earlier than paying again the mortgage.
The ultimate distinction, and the estimated loss for Platypus, was $9 million. A lot of the stolen funds reportedly stay within the attacker’s contract deal with, although some have been despatched to sure swimming pools. Presumably, a portion of that quantity will be returned or recovered.
Platypus confirmed the flash mortgage assault in a message on Telegram and Discord. It wrote that it’s assessing the state of affairs and can pause operations.
This line of assault just isn’t distinctive to Platypus. A number of different DeFi platforms have been focused by flash loans in current months, together with Mango Markets in October, New Free DAO in September, Nirvana Finance final July, and Deus DAO final April.
