Platypus Finance Second & Third Exploits

In October 2023, the Avalanche stableswap Platypus Finance suffered a cluster of further exploits totalling approximately $2.2 million — coming months after its $8.5M February 2023 incident. The October exploits again involved flawed solvency / withdrawal accounting in the protocol's AMM and lending logic.

What happened

Following the February 2023 emergencyWithdraw exploit, Platypus continued operating with redesigned contracts. In October 2023 it was exploited again in two to three closely-spaced incidents, exploiting weaknesses in the protocol's collateral/solvency calculations. A portion of funds was recovered (one attacker was identified; some funds frozen/returned).

Aftermath

• Platypus paused and patched repeatedly; recovery was partial.
• The protocol's repeated incidents severely eroded its standing among Avalanche DeFi protocols.

Why it matters

Platypus joins DEUS DAO, Cream Finance, Abracadabra, and ALEX Lab in the catalogue's multi-incident protocol group. The pattern is consistent and, by now, predictable: a protocol exploited once, whose remediation addresses the specific bug rather than the systemic deficit, is exploited again — usually within a year. Platypus's February → October 2023 sequence is one of the tighter examples. The verdict the catalogue repeatedly reaches: after the second incident, continued user trust is empirically misplaced, and the third incident is the confirmation rather than the surprise.