Two siblings who hacked the decentralized finance protocol called Platypus and stole $8.5 million have been released without any charges by the French court. This decision has sparked a serious debate within the crypto community.
On February 16, black hat hackers carried out a flash loan attack on Platypus, stealing $8.5 million and causing the suspension of the protocol’s trading services until a solution was found. During the preliminary investigations, it was determined that an individual named Mohammed M. exploited a code vulnerability to seize all assets using a protected loan intermediary.
The duo, who had been in custody since February 24, admitted to the theft during a hearing on October 26, but described themselves as ethical hackers. They also mentioned plans to return 10% of the stolen assets as compensation.
The hacker siblings were acquitted of all charges on the grounds that the attack resembled a bug bounty initiative. During the attack, €7.8 million worth of crypto assets were transferred to a wallet and subsequently became inaccessible. Platypus recently disclosed another loss of $2.2 million due to a separate flash loan attack.
According to a research conducted by blockchain security firm CertiK on October 12, the attack occurred in three stages, involving various cryptocurrencies worth $2.23 million, $575,000, and $450,000 respectively. Platypus reached a settlement with the hacker on October 17, managing to recover 90% of the stolen assets.