On October 16, 2024, Radiant Capital, a decentralized cross-chain lending protocol built on LayerZero, was the victim of a highly sophisticated cyberattack that resulted in a staggering $50 million loss.
The attack has since been linked to North Korean hackers, marking another alarming chapter in the growing wave of cybercrime targeting decentralized finance (DeFi).
Report Links North Korean Actors to Radiant Capital Incident
A report from OneKey, a Coinbase-backed crypto hardware wallet manufacturer, attributed the attack to North Korean hackers. The report extends from a recent medium post shared by Radiant Capital, which provided an incident update on the October 16 attack.
Reportedly, Mandiant, a leading cybersecurity firm, further linked the breach to UNC4736, a DPRK-aligned group also known as AppleJeus or Citrine Sleet. This group operates under the Reconnaissance General Bureau (RGB), North Korea’s primary intelligence agency.
Mandiant’s investigation revealed that the attackers meticulously planned their operation. They staged malicious smart contracts across multiple blockchain networks, including Arbitrum, Binance Smart Chain, Base, and Ethereum. These efforts reflect the advanced capabilities of DPRK-backed threat actors in targeting the DeFi sector.
The breach began with a calculated phishing attack on September 11, 2024. A Radiant Capital developer received a Telegram message from an individual impersonating a trusted contractor. The message included a zip file purportedly containing a smart contract audit report. This file, “Penpie_Hacking_Analysis_Report.zip,” was laced with malware known as INLETDRIFT, a macOS backdoor that facilitated unauthorized access to Radiant’s systems.
When the developer opened the file, it appeared to contain a legitimate PDF. However, the malware silently installed itself, establishing a backdoor connection to a malicious domain at atokyonews[.]com. This allowed the attackers to spread the malware further among Radiant’s team members, gaining deeper access to sensitive systems.
The hackers’ strategy culminated in a man-in-the-middle (MITM) attack. By exploiting compromised devices, they intercepted and manipulated transaction requests within Radiant’s Gnosis Safe Multisig wallets. While transactions appeared legitimate to developers, the malware covertly altered them to execute a transfer Ownership call, seizing control of Radiant’s lending pool contracts.
Industry experts, however, believe such incidents could have been prevented. Yehor Rudytsia, a Web3 researcher at Hacken, told BeInCrypto that using a framework like the Cryptocurrency Security Standard (CCSS) might have offered early protection and helped avoid these types of attacks.
“CCSS encompasses key lifecycle management, from secure generation and storage to the proper usage of private keys. Even a basic CCSS-compliant multisig setup could have mitigated the risk by enforcing stricter control over key handling and reducing exposure to malware-driven attacks,” Rudytsia said.
Execution of the Heist, Industry Implications, and Lessons Learned
Despite Radiant’s adherence to best practices, such as using hardware wallets, transaction simulations, and verification tools, the attackers’ methods bypassed all defenses. Within minutes of securing ownership, the hackers drained funds from Radiant’s lending pools, leaving the platform and its users reeling.
The Radiant Capital hack serves as a stark warning to the DeFi industry. Even projects adhering to rigorous security standards can fall prey to sophisticated threat actors. The incident highlighted critical vulnerabilities, including:
- Phishing Risks: The attack began with a convincing impersonation scheme, emphasizing the need for heightened vigilance against unsolicited file sharing.
- Blind Signing: While essential, hardware wallets often display only basic transaction details, making it difficult for users to detect malicious modifications. Improved hardware-level solutions are necessary to decode and validate transaction payloads.
- Front-End Security: The reliance on front-end interfaces for transaction verification proved inadequate. Spoofed interfaces enabled hackers to manipulate transaction data undetected.
- Governance Weaknesses: The absence of mechanisms to revoke ownership transfers left Radiant’s contracts vulnerable. Implementing time locks or requiring delayed fund transfers could provide critical reaction time in future incidents.
In response to the breach, Radiant Capital has engaged leading cybersecurity firms, including Mandiant, zeroShadow, and Hypernative. These firms assist in the investigation and asset recovery. The Radiant DAO is also collaborating with US law enforcement to trace and freeze stolen funds.
“Collaboration remains vital — sharing threat intelligence with cybersecurity firms and global law enforcement can expedite response efforts and assist in tracing stolen assets. The DeFi industry should also invest in dedicated response task forces, promote cross-border cooperation, and encourage standardized security frameworks to safeguard user assets and reinforce trust in decentralized systems,” Yehor Rudytsia told BeInCrypto.
In the Medium post, Radiant also reaffirmed its commitment to sharing lessons learned and enhancing security across the DeFi industry. The DAO emphasized the importance of adopting strong governance frameworks, strengthening device-level security, and moving away from risky practices like blind signing.
The Radiant Capital incident aligns with a recent report, which indicated how North Korean hackers continue to shift tactics. As cybercriminals grow more sophisticated, the industry must adapt by prioritizing transparency, strong security measures, and collaborative efforts to combat such attacks.
Disclaimer
In adherence to the Trust Project guidelines, BeInCrypto is committed to unbiased, transparent reporting. This news article aims to provide accurate, timely information. However, readers are advised to verify facts independently and consult with a professional before making any decisions based on this content. Please note that our Terms and Conditions, Privacy Policy, and Disclaimers have been updated.
