DeFi Protocol Platypus Recovers Millions in Stolen USDC After Hack
DeFi protocol Platypus recently suffered a hack, resulting in almost $9.1 million being lost.
However, blockchain security firm BlockSec was able to recover at least 2.4 million USDC, freeze $8.5 million in the contract they were transferred to, and accidentally receive $380,000 from a second attempt to exploit back to Aave.
The attacker could only cash out $270,000, as revealed by MetalSleuth, a visualization tool from Blocksec.
BlockSec retrieved the stolen funds by exploiting a loophole in the attacker’s contract, taking advantage of a callback function that approved USDC to the project’s contract and withdrew it from the attacker’s contract.
During the callback function, the attacker hardcoded the logic to approve USDC to the project’s contract, which is a proxy. This callback function was used in the attack, as it lacked access control.
BlockSec’s successful recovery of the stolen funds demonstrates the importance of blockchain security measures in protecting assets and mitigating losses.
Author
Alexander Stefanov
Reporter at CoinsPress
Alex is Editor-in-Chief of Coinspress and co-founder of Millennial Media Group, with nearly a decade of experience covering financial markets - crypto first, then everything else.
It started in 2016 with Bitcoin. Like most people at the time, he didn't fully understand it - so he kept digging. Blockchain, tokenomics, the projects, the cycles. That curiosity never stopped, and eventually pulled him into traditional markets too: equities, commodities, macro. Not because he left crypto behind, but because you can't properly understand one without the other.
What drives him is straightforward: he wants to know why something is happening, not just that it's happening. Most market coverage stops at the headline - price up, price down, here's a chart. Alex finds that kind of reporting actively unhelpful. If you walk away from an article without understanding the mechanism behind the move, what did you actually learn?
He holds a degree in Tourism from New Bulgarian University - not the most obvious path into financial markets, but markets have a way of pulling in people who are simply too curious to stay out. He has authored over 200 in-depth analyses and more than 10,000 articles across crypto and traditional finance. He still thinks every day in markets teaches him something new. That's probably why he hasn't stopped.
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.