In a surprising turn of events, a French court has cleared the individuals responsible for the $8.5 million hack of Platypus Finance in February 2023.

The court acquitted Mohammed M., 22, who orchestrated the sophisticated flash loan attack on the Automated Market Maker (AMM) protocol based on the Avalanche network.

Despite exploiting a smart contract vulnerability to drain funds, the court rejected prosecutors' demands for multi-year prison sentences.

Legal Ruling and Technical Tracking

Le Monde reports that investigators relied on cryptography pioneers like ZachXBT to trace the stolen crypto back to the perpetrators just one week after the Platypus Finance breach.

The court ruled that Mohammed's use of publicly accessible smart contracts did not constitute illegal intrusion under criminal statutes. Additionally, exploiting Platypus's flawed emergency withdrawal mechanism to siphon tokens did not meet the legal criteria for fraud.

Ethical Hacker Defence

Mohammed claimed to be an "ethical hacker," asserting that he intended to return the funds and aimed to qualify for a 10% white-hat bounty. However, his mishandling of decryption keys resulted in the permanent locking of a significant portion of the stolen funds.

Platypus initiated a counter-hack to recover some of the stolen USD Coin (USDC) still deposited in AMM liquidity pools.

Flash Loan Fallout

During the flash loan attack, Mohammed mistakenly locked away millions of dollars of stolen funds and only managed to recover around $270,000. Platypus, through its counter-hack, salvaged $2.4 million in USDC.

The court's decision to drop charges related to unauthorized access, fraud, money laundering, and receiving stolen goods underscores the unique challenges in applying existing legal frameworks to decentralized finance (DeFi) incidents.

Jurisdictional Complexities and Future Implications

The prosecution's failure highlights the evolving jurisdiction of DeFi criminal enforcement. While protocols can pursue damages through civil court, the lack of clarity under current criminal regulations, coupled with the global nature of decentralized networks, raises questions about the adequacy of existing legal frameworks in addressing emerging challenges in the DeFi space.

The court's reminder that Platypus could still pursue civil action adds a layer of complexity to the aftermath of this high-profile case.