In a surprising twist of events, a French court acquitted the individuals responsible for the $8.5 million Platypus Finance hack that occurred in February 2023.
The court found Mohammed M., 22, not guilty of orchestrating a sophisticated flash lending attack against the Automated Market Maker (AMM) protocol underlying the Avalanche network.
Despite exploiting a vulnerability in a smart contract to extract funds, the court rejected prosecutors’ request for a multi-year prison sentence.
Le Monde reported that investigators relied on cryptocurrency pioneers like ZachXBT to trace stolen cryptocurrencies to the perpetrators a week after the Platypus Finance breach.
The court ruled that Mohammed’s use of a publicly accessible smart contract did not constitute trespass under criminal law. Additionally, exploiting Platypus’ flawed emergency withdrawal mechanism to siphon tokens did not meet the legal criteria for fraud.
Mohammed described himself as an “ethical hacker” and claimed his goal was to return the funds and qualify for a 10% white hat bounty. However, his mishandling of the decryption key resulted in a significant portion of the stolen funds being permanently locked out.
Platypus has launched a counterattack to recover some of the stolen USD Coins (USDC) still held in AMM liquidity pools.
During the flash loan attack, Mohammed accidentally locked away millions of dollars in stolen funds and only recovered about $270,000. Platypus recovered $2.4 million in USDC through counter hacking.
The court’s decision to drop charges related to unauthorized access, fraud, money laundering and receiving stolen property highlights the unique challenges of applying existing legal frameworks to decentralized finance (DeFi) incidents.
The prosecution’s failure highlights the evolving jurisdiction of DeFi crime enforcement. Protocols can seek damages through civil courts, but the current lack of clarity under criminal regulations and the global nature of decentralized networks raise questions about the adequacy of existing legal frameworks to address emerging issues in the DeFi space. It is raised.
The court’s reminder that Platypus can still file civil lawsuits further complicates the aftermath of this notable case.