Radiant Capital hack — October 2024

On 16 October 2024 attackers took control of the multisig that administered Radiant Capital's lending markets and drained roughly $50 million from its Arbitrum and BNB Chain deployments. Radiant's post-mortem describes malware sitting between the signers and the Safe{Wallet} interface: signers saw and approved what looked like routine transactions while the payload sent to their hardware wallets was a transferOwnership call. Three of the eleven signers on the 3-of-11 Arbitrum multisig signed it. At 17:09:18 UTC control of the Arbitrum LendingPoolAddressesProvider passed to an attacker-controlled address, and the BNB Chain equivalent followed at 17:11:00 UTC. Malicious contracts had already been deployed on both chains on 2 October. An automated pause was triggered on Ethereum mainnet and a pause transaction was executed on Base before those markets could be drained. Beyond the core pools, the attackers exploited open approvals users had left in place to withdraw tokens directly from their accounts.

Mandiant, retained by Radiant, attributed the intrusion to UNC4736, also tracked as AppleJeus and Citrine Sleet, and assessed with high confidence that the group has a DPRK nexus. The initial compromise dates to 11 September 2024, when a developer received a Telegram message impersonating a former contractor carrying INLETDRIFT, a macOS backdoor disguised as a report on the Penpie hack.

Figures differ. Radiant's own post-mortem says approximately $50 million. The Block reported $51 million on the day. Crypto.news reports approximately $53 million. None of the funds were recovered. TVL fell to about $5 million within weeks of the breach, and in June 2026 Radiant's DAO announced that development, upgrades and expansion would cease and the protocol would move to a maintenance state, with the frontend online and users able to withdraw, repay and manage existing positions. The Defiant reported at the same time that no formal wind-down notice had been posted to Radiant's X account or its governance forum, and that TVL stood at $2.21 million.