Timeline | Stablecoin Platypus attacked, losing over $2 million.

On October 12th, according to data monitored by Paiduin, the stablecoin trading project Platypus on the Avalanche chain was attacked, resulting in a loss of over $2 million. It is reported that Platypus suspended its funding pool and conducted an investigation at 14:50 on October 12th. With the help of the security platform Supremacy, they successfully recovered about 50,000 sAVAX and 7,000 AVAX from one of the attackers.

Following is the timeline of events related to this incident, as compiled and updated by BlockBeats:

10-12 15:24

Stablecoin trading project Platypus suffers attack, losing over $2 million

BlockBeats News, October 12th. According to the monitoring data of Paidu Shield, Platypus, a stablecoin trading project on the Avalanche chain, was attacked and lost more than 2 million US dollars. As previously reported by BlockBeats, on July 12th, Platypus was attacked again. Due to the price difference between the two pools not being considered when exchanging tokens through CoverageAratio, users were able to arbitrage by depositing USDC and then withdrawing more USDT. Arbitrageurs were able to arbitrage about 50,000 USDC in this way. On February 17th, Platypus, the native stablecoin USP of the Avalanche ecosystem StableSwap project, suffered a flash loan attack by hackers, resulting in a loss of approximately 8.5 million US dollars.

10-12 15:26

Stablecoin trading project Platypus has suspended all asset pools.

BlockBeats News, on October 12th, Platypus, a stablecoin trading project in the Avalanche ecosystem, announced that it has taken proactive measures to suspend all asset pools due to suspicious activities in the protocol.

10-13 08:28

Platypus: sAVAX-AVAX pool lost about $2.2 million and has recovered 50,000 sAVAX and 7,000 AVAX

BlockBeats News, on October 13th, stablecoin trading project Platypus Finance announced that a security incident occurred between 11:29 and 14:17 on October 12th, resulting in a loss of approximately $2.2 million in the sAVAX-AVAX pool. Platypus suspended the fund pool and conducted an investigation at 14:50, and successfully recovered about 50,000 sAVAX and 7,000 AVAX from one of the attackers with the help of the security platform Supremacy. Platypus is working with security experts to identify and correct vulnerabilities. Platypus will not restart the fund pool until the issue is completely resolved and security measures are strengthened.

This year, Platypus has been attacked multiple times. The following is a timeline of the attack on Platypus in February:

02-17 10:05

Platypus: Stablecoin USP suffers lightning loan attack by hackers, losing about $8.5 million, and is exploring compensation solutions.

BlockBeats News, on February 17th, the official of Platypus, the StableSwap project in the Avalanche ecosystem, stated that its native stablecoin USP was attacked by a flash loan hack and is currently formulating a comprehensive recovery plan and will promptly update the community on the latest situation. The attacker used flash loans to exploit logic errors in the USP solvency check mechanism in contracts that hold collateral. The main pool lost a total of $8.5 million. Platypus has contacted the hacker to negotiate the return of stolen funds through a bounty program. At the same time, the stolen USDT and BUSD have been frozen, and the relevant USDC has been applied for freezing to Circle. According to CoinGecko data, USP has unpegged to $0.479.

02-17 19:58

Founder of SlowMist: Platypus hacker did not implement withdrawal function in contract, resulting in 8.5 million US dollars of "stolen funds" unable to be withdrawn

BlockBeats News, on February 17th, SlowMist founder Yu Xian commented on the theft of $8.5 million from Platypus, stating on social media that "after decompiling the attack contract, it was discovered that the attacker did not implement the withdrawal function in the contract, resulting in the inability to extract the attack proceeds, and the $8.5 million is sealed in the attack contract." According to CoinGecko data, USP (Platypus USD) has now unpegged to $0.479.

02-18 09:44

Security company BlockSec helps Platypus recover $2.4 million stolen funds

BlockBeats news, on February 18th, according to The Block, at least $2.4 million has been recovered with the help of blockchain security company BlockSec after the StableSwap project Platypus in the Avalanche ecosystem was hacked. Earlier, Platypus announced on February 17th that its native stablecoin USP was attacked by a flash loan, and the attacker used a logic error in the USP solvency check mechanism in the contract that holds the collateral. The main pool lost a total of $8.5 million.

02-19 11:55

Platypus is formulating a compensation plan and may release a recovery proposal on AAVE.

BlockBeats News, on February 19th, Avalanche ecosystem StableSwap project Platypus announced that it is developing a user loss compensation plan and reminded users not to repay the stablecoin USP. In addition, liquidation has been suspended and users do not need to worry about liquidation issues. Platypus also stated that some funds are trapped in AAVE, so it is exploring a possible way to recover these funds, which will require a recovery proposal to be submitted and passed on the AAVE governance forum. BlockBeats previously reported that on February 17th, Platypus announced that its native stablecoin USP had been hacked and was developing a comprehensive recovery plan and will timely inform the community of the latest developments.

02-24 08:44

Platypus compensation plan update: at least 63% of affected LP funds will be refunded

BlockBeats News, on February 24th, Platypus, a stablecoin trading project on the Avalanche chain, announced compensation plans and attack details after the project was attacked. After the attack, about 35.4% of the funds remained in the main pool. Platypus will use all the surplus in the main pool to compensate for the losses of affected LPs. As Platypus has recovered $2.4 million (17.7% of pre-attack assets) from the attack contract, about 53.1% of the pool funds will be returned to all affected LPs. Platypus stated that it will keep in touch with the stablecoin issuer to recover the lost stablecoins, and will not use the treasury for refunds initially for negotiation purposes. The treasury will be reserved for six months, and if the situation improves, all $1.4 million (10.4% of pre-attack assets) in treasury assets will be distributed to all affected LPs. This means that at least 63% of the funds will be allocated to users regardless of whether the stolen funds are recovered. In addition, if Platypus's proposal submitted to Aave is approved and Tether confirms the re-minting of frozen USDT, about 78% of user funds can be recovered. In mid-February, Platypus suffered three separate attacks, resulting in a total loss of $9.19 million.

02-24 16:29

SlowMist: Platypus attacker exchanged 10,654 AVAX for 127 WETH and transferred to Ethereum network

BlockBeats News, on February 24th, according to the MistTrack data from SlowMist, the Platypus attacker exchanged 10,654 AVAX for 127 WETH and transferred them across chains to the Ethereum network.

02-26 08:53

French national police have arrested two Platypus attack suspects

BlockBeats News, on February 26th, Platypus, a stablecoin trading project on the Avalanche chain, announced that with the assistance of Binance and on-chain data analyst ZachXBT, the French national police have arrested and summoned two Platypus attack suspects. Platypus previously stated in a blog post that it had confirmed the identity of the attacker in cooperation with Binance, had contacted French law enforcement agencies, and had appealed. Platypus promised to reimburse users for at least 63% of the funds. Last week, hackers exploited a vulnerability in Platypus' ability to pay mechanism and stole about $9.2 million in digital assets, causing its native stablecoin USP to decouple from the US dollar.

03-01 08:52

Stablecoin trading project Platypus launches compensation page, first compensation to be issued within three months

BlockBeats News, on March 1st, Platypus Finance, a stablecoin trading project on the Avalanche chain, launched a compensation page for victims of a hacker attack. Users can view their balance before and after the attack, and if there are any errors, they can submit a Google form with supporting evidence. The submission deadline is 7:59 on March 4th Beijing time. After receiving feedback and completing the calculation, the team will prepare the first compensation within three months. As previously reported by BlockBeats, on February 17th, Platypus announced that its stablecoin USP suffered a lightning loan attack by hackers, resulting in a loss of about $8.5 million, and is exploring compensation plans.

07-12 15:16

SlowMist: Platypus suffers another attack, with arbitrageurs gaining about $50,000 in profit

BlockBeats News, on July 12th, SlowMist announced on social media that Platypus, a stablecoin trading project on the Avalanche chain, has been attacked again. Due to the lack of consideration of the price difference between the two pools when exchanging tokens through CoverageAratio, users were able to arbitrage by depositing USDC and then withdrawing more USDT. Arbitrageurs thus profited approximately 50,000 USDC.

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia