{"investigation":{"slug":"radiant-v2","entity_name":"Radiant V2","trust_score":10,"severity_base":null,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"Radiant Capital is a decentralized cross-chain lending protocol built on LayerZero that suffered two significant security incidents in 2024: a $4.5 million flash loan exploit in January 2024 and a far more devastating $50 million multisig compromise in October 2024. The October hack, attributed by Mandiant with high confidence to North Korean state-sponsored group UNC4736 (Citrine Sleet / AppleJeus), involved a months-long social engineering campaign, macOS malware deployment on developer devices, and manipulation of hardware wallet signing interfaces to drain funds across BNB Chain and Arbitrum.","sections":[{"content":"Radiant Capital is a decentralized omnichain money market protocol that enables users to lend and borrow assets across multiple blockchains including Arbitrum, BNB Chain, Ethereum, and Base. The protocol is built on LayerZero's cross-chain messaging infrastructure, which provides the technical foundation for its multi-chain liquidity pools. The RDNT governance and utility token was fair-launched on Arbitrum in July 2022 via Sushiswap, with a total supply of 1,500,000,000 tokens. Radiant V2 expanded beyond Arbitrum to additional chains using LayerZero's OFT (Omnichain Fungible Token) standard, which allows RDNT to exist across multiple blockchains while maintaining a unified supply. At its peak, the protocol managed over $300 million in total value locked (TVL). The protocol's multi-chain design — while commercially differentiating — introduced a broad attack surface, as administrative keys and cross-chain message passing each represent potential compromise vectors.","heading":"Background","sources":[{"url":"https://www.nansen.ai/post/what-is-radiant-capital-cross-chain-defi-explained","name":"","type":"other","credibility":3},{"url":"https://www.datawallet.com/crypto/radiant-capital-explained","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"On October 16, 2024, Radiant Capital suffered a highly sophisticated cyberattack resulting in the loss of approximately $50–53 million USD. The attack exploited a 3-of-11 multisig governance configuration: attackers compromised the hardware wallets of at least three protocol developers through a macOS malware payload named INLETDRIFT, delivered via a social engineering campaign that began on September 11, 2024. On that date, a Radiant developer received a Telegram message from an account impersonating a trusted former contractor, requesting feedback on a smart contract auditing report. The message included a link to a ZIP archive — 'Penpie_Hacking_Analysis_Report.zip' — hosted on a spoofed domain mimicking the contractor's legitimate website. The archive contained a decoy PDF and the INLETDRIFT backdoor, which established persistence on the infected macOS device via LaunchDaemons and communicated with the command-and-control domain atokyonews[.]com. Once deployed on multiple developer machines, INLETDRIFT manipulated the Gnosis Safe (Safe{Wallet}) browser front-end to display legitimate transaction data while sending different, malicious transactions to the connected Ledger hardware wallets for signing. Because Ledger hardware wallets do not independently parse Gnosis Safe transaction data, developers signed what appeared to be routine protocol transactions without realizing they were authorizing a transferOwnership() call on the LendingPoolAddressesProvider contract. Routine transaction failures — common in normal DeFi operations — masked the repeated signing attempts. Tenderly transaction simulations also returned normal results, bypassing that layer of verification. Using the three compromised signatures, the attacker transferred ownership of the lending pool contracts to a malicious contract, which then upgraded pool implementations to compromised versions granting the attacker withdrawAccess to user deposited funds. Malicious contracts were deployed across four chains (BSC, Arbitrum, Base, and Ethereum), though only the attacks on BSC and Arbitrum succeeded. Assets drained included USDC, WBNB, ETH, and other tokens. The attacker removed all traces of the backdoor within approximately three minutes of executing the theft.","heading":"The $50M October 2024 Hack","sources":[{"url":"https://medium.com/@RadiantCapital/radiant-capital-incident-update-e56d8c23829e","name":"","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-radiant-capital-hack-october-2024","name":"","type":"other","credibility":3},{"url":"https://www.coindesk.com/tech/2024/10/16/radiant-capital-loses-50m-to-blockchain-exploit","name":"","type":"other","credibility":3},{"url":"https://decrypt.co/287162/radiant-capitals-50m-breach-among-most-sophisticated-hacks-in-defi-history","name":"","type":"other","credibility":3},{"url":"https://medium.com/@RadiantCapital/radiant-post-mortem-fecd6cd38081","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"On January 2, 2024, Radiant Capital suffered an earlier, unrelated exploit resulting in the loss of approximately $4.5 million in ETH. The attack occurred within seconds of the protocol activating a new native USDC market on Arbitrum. The root cause was a rounding error in the codebase — specifically a cumulative precision error in the liquidityIndex calculation, a parameter that determines user balances and serves as a denominator in key computations. The attacker manipulated the liquidityIndex to become artificially large, magnifying the precision error and enabling repeated profitable deposit() and withdraw() operations using a flash loan. The exploit is consistent with a known vulnerability pattern affecting lending markets forked from Compound and Aave when a new market is first activated. The protocol incurred bad debt in the WETH market totaling approximately 1.3% of total protocol TVL. Radiant immediately paused lending and borrowing markets on Arbitrum, pledged a full post-mortem, and later initiated a debt repayment plan for affected users. The protocol resumed normal operations after the investigation concluded.","heading":"Earlier January 2024 Hack","sources":[{"url":"https://cointelegraph.com/news/radiant-capital-lending-protocol-flash-loan-attack-arbitrum","name":"","type":"other","credibility":3},{"url":"https://www.cryptopolitan.com/radiant-capital-repayment-flash-loan-exploit/","name":"","type":"other","credibility":3},{"url":"https://blog.quillaudits.com/trending/radiant-capital-hack-analysis/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"On-chain analytics firms tracked the movement of stolen funds following the October 2024 exploit. CertiK analysis documented that the hacker routed funds through multiple cross-chain bridges, including Stargate Bridge, Synapse Bridge, and Drift FastBridge. Approximately 2,213.8 ETH were bridged from Arbitrum to an externally owned account (EOA) at address 0x4afb. In August 2025, blockchain monitors observed the attacker swapping approximately 3,091 ETH for 13.26 million DAI stablecoins, with the DAI then moved through a series of intermediate wallets before being converted back to ETH. Separate monitoring in August 2025 documented the attacker selling 9,631 ETH at $4,562 into DAI, then repurchasing 2,109.54 ETH at $4,096 — effectively a 10.6% arbitrage gain on the stolen principal. Reports indicate the total portfolio value of stolen funds grew from approximately $53 million at theft to over $94 million by mid-2025 due to ETH price appreciation and active trading by the attacker. In October 2025, the exploiter deposited 2,834.6 ETH (approximately $10.8 million) into Tornado Cash, a sanctioned cryptocurrency mixer, in an apparent laundering operation. Radiant Capital has engaged Chainalysis, zeroShadow, Hypernative, the FBI, and SEAL 911 to track and attempt recovery of the stolen assets. Recovery prospects are considered low given Tornado Cash involvement and the sophisticated operational security maintained by the attacker.","heading":"On-Chain Evidence","sources":[{"url":"https://coincentral.com/radiant-capital-hacker-launders-10-8m-through-tornado-cash-mixer/","name":"","type":"other","credibility":3},{"url":"https://crypto.news/radiant-capital-hack-funds-shift-as-13m-in-eth-swapped-for-dai/","name":"","type":"other","credibility":3},{"url":"https://news.shib.io/2024/10/24/radiant-capital-hacker-transfers-52m-in-stolen-funds-to-ethereum/","name":"","type":"other","credibility":3},{"url":"https://crypto.news/radiant-capital-hacker-doubles-funds-eth-trading-2025/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"In December 2024, Radiant Capital publicly attributed the October 2024 hack to UNC4736, a North Korean state-sponsored threat actor tracked by Mandiant. Mandiant assessed with high confidence that UNC4736 has a DPRK nexus, specifically aligned with North Korea's Reconnaissance General Bureau (RGB). The group is also tracked under the aliases AppleJeus and Citrine Sleet, and is assessed to have close ties to TEMP.Hermit, another DPRK-linked cluster. UNC4736 / Citrine Sleet is best known for targeting cryptocurrency firms and DeFi protocols through advanced social engineering combined with bespoke malware. The INLETDRIFT malware employed in the Radiant attack is consistent with previously documented AppleJeus tooling, which uses macOS-targeting backdoors disguised as legitimate documents. Mandiant's attribution is based on device-level forensic analysis conducted in the weeks following the breach. Radiant Capital coordinated with U.S. law enforcement following the attribution disclosure. The Radiant attack is one of several DeFi exploits in 2024–2025 attributed to North Korean-affiliated hacking units, consistent with U.S. government findings that the DPRK uses crypto theft to fund its weapons programs.","heading":"North Korea Attribution","sources":[{"url":"https://www.coindesk.com/tech/2024/12/09/radiant-capital-says-north-korean-hackers-behind-50-million-attack-in-october","name":"","type":"other","credibility":3},{"url":"https://www.bleepingcomputer.com/news/security/radiant-links-50-million-crypto-heist-to-north-korean-hackers/","name":"","type":"other","credibility":3},{"url":"https://www.securityweek.com/radiant-capital-50-million-heist-blamed-on-north-korean-hackers/","name":"","type":"other","credibility":3},{"url":"https://beincrypto.com/north-korea-radiant-capital-hack/","name":"","type":"other","credibility":3},{"url":"https://medium.com/@RadiantCapital/radiant-capital-incident-update-e56d8c23829e","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Radiant Capital presents an extreme risk profile for users and depositors as of 2026. The protocol has suffered two separate security incidents within a single calendar year (2024), losing a combined total of approximately $54.5 million. The October 2024 incident in particular represents a systemic governance failure: even hardware wallets, multi-party signing schemes, and transaction simulation tools (Tenderly) were defeated by a sophisticated state-sponsored adversary. The 3-of-11 multisig threshold was insufficient to prevent compromise, and the attacker's ability to manipulate hardware wallet signing interfaces without detection exposes a structural weakness in current DeFi operational security practices. While Radiant has engaged industry-leading security firms (Mandiant, Chainalysis, SEAL 911) and cooperated with U.S. law enforcement, recovery of stolen funds is considered highly unlikely given that the attacker has actively laundered funds through Tornado Cash and demonstrated advanced counter-surveillance capabilities. The stolen portfolio has grown substantially in value due to active trading, providing the attacker with additional resources and reducing urgency to liquidate through traceable channels. Users who had funds deposited in Radiant V2 markets on Arbitrum and BNB Chain at the time of the October 2024 exploit lost those funds with no confirmed path to recovery. The protocol's cross-chain architecture, while innovative, amplified the attack surface and enabled rapid fund movement across multiple chains. AVOID.NET rates Radiant V2 as critical risk. No new deposits are advisable until a comprehensive governance restructuring, independent security audit, and proof of enhanced operational security are publicly verified.","heading":"Risk Assessment","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-radiant-capital-hack-october-2024","name":"","type":"other","credibility":3},{"url":"https://cryptoslate.com/radiant-capital-teams-with-us-law-enforcement-after-50m-defi-hack/","name":"","type":"other","credibility":3},{"url":"https://coincentral.com/radiant-capital-hacker-launders-10-8m-through-tornado-cash-mixer/","name":"","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2022-07","event":"Radiant Capital launches RDNT token on Arbitrum via Sushiswap fair launch.","source":"","date_original":"2022-07-01"},{"date":"2024-01-02","event":"Flash loan exploit drains $4.5 million ETH from newly activated USDC market on Arbitrum via rounding error in liquidityIndex calculation.","source":""},{"date":"2024-01-03","event":"Radiant pauses Arbitrum lending and borrowing markets; promises post-mortem and user repayment.","source":""},{"date":"2024-09-11","event":"North Korean UNC4736 attacker sends malicious Telegram message to Radiant developer, impersonating a former contractor; INLETDRIFT macOS malware deployed via ZIP file.","source":""},{"date":"2024-10-16","event":"Attackers exploit compromised hardware wallets of at least 3 of 11 multisig signers to execute transferOwnership() on LendingPoolAddressesProvider; approximately $50–53 million drained from BSC and Arbitrum markets. Backdoor removed within 3 minutes of theft.","source":""},{"date":"2024-10-17","event":"Radiant publishes initial post-mortem; engages Mandiant, zeroShadow, Hypernative, and SEAL 911.","source":""},{"date":"2024-10-24","event":"On-chain tracking confirms hacker bridges $52M in stolen funds to Ethereum.","source":""},{"date":"2024-12-06","event":"Radiant Capital publishes updated incident report attributing attack to UNC4736 (North Korea) based on Mandiant forensic analysis.","source":""},{"date":"2024-12-09","event":"Public attribution of attack to DPRK-linked UNC4736 / Citrine Sleet / AppleJeus group reported by major media.","source":""},{"date":"2025-08","event":"On-chain monitors observe hacker actively trading stolen ETH and DAI; stolen portfolio value reportedly grows from $53M to over $94M through ETH appreciation and active arbitrage.","source":"","date_original":"2025-08-01"},{"date":"2025-10","event":"Hacker deposits 2,834.6 ETH (approximately $10.8M) into sanctioned mixer Tornado Cash, substantially reducing recovery prospects.","source":"","date_original":"2025-10-01"}],"sources_used":[{"url":"https://www.nansen.ai/post/what-is-radiant-capital-cross-chain-defi-explained","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.datawallet.com/crypto/radiant-capital-explained","name":"","type":"other","archive_url":"http://web.archive.org/web/20260217111353/https://www.datawallet.com/crypto/radiant-capital-explained","credibility":3,"archive_timestamp":"2026-02-17T11:13:53+00:00"},{"url":"https://medium.com/@RadiantCapital/radiant-capital-incident-update-e56d8c23829e","name":"","type":"other","archive_url":"http://web.archive.org/web/20260714170524/https://medium.com/@RadiantCapital/radiant-capital-incident-update-e56d8c23829e","credibility":3,"archive_timestamp":"2026-07-14T17:05:24+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-radiant-capital-hack-october-2024","name":"","type":"other","archive_url":"http://web.archive.org/web/20260609212631/https://www.halborn.com/blog/post/explained-the-radiant-capital-hack-october-2024","credibility":3,"archive_timestamp":"2026-06-09T21:26:31+00:00"},{"url":"https://www.coindesk.com/tech/2024/10/16/radiant-capital-loses-50m-to-blockchain-exploit","name":"","type":"other","archive_url":"http://web.archive.org/web/20260420091309/https://www.coindesk.com/tech/2024/10/16/radiant-capital-loses-50m-to-blockchain-exploit","credibility":3,"archive_timestamp":"2026-04-20T09:13:09+00:00"},{"url":"https://decrypt.co/287162/radiant-capitals-50m-breach-among-most-sophisticated-hacks-in-defi-history","name":"","type":"other","archive_url":"http://web.archive.org/web/20260509143705/https://decrypt.co/287162/radiant-capitals-50m-breach-among-most-sophisticated-hacks-in-defi-history","credibility":3,"archive_timestamp":"2026-05-09T14:37:05+00:00"},{"url":"https://medium.com/@RadiantCapital/radiant-post-mortem-fecd6cd38081","name":"","type":"other","archive_url":"http://web.archive.org/web/20260312013900/https://medium.com/@RadiantCapital/radiant-post-mortem-fecd6cd38081","credibility":3,"archive_timestamp":"2026-03-12T01:39:00+00:00"},{"url":"https://cointelegraph.com/news/radiant-capital-lending-protocol-flash-loan-attack-arbitrum","name":"","type":"other","archive_url":"http://web.archive.org/web/20260825111813/https://cointelegraph.com/news/radiant-capital-lending-protocol-flash-loan-attack-arbitrum","credibility":3,"archive_timestamp":"2026-08-25T11:18:13+00:00"},{"url":"https://www.cryptopolitan.com/radiant-capital-repayment-flash-loan-exploit/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260215180851/https://www.cryptopolitan.com/radiant-capital-repayment-flash-loan-exploit/","credibility":3,"archive_timestamp":"2026-02-15T18:08:51+00:00"},{"url":"https://blog.quillaudits.com/trending/radiant-capital-hack-analysis/","name":"","type":"other","archive_url":"https://web.archive.org/web/20260901070541/https://www.quillaudits.com/blog","credibility":3,"archive_timestamp":"2026-09-01T07:05:41+00:00"},{"url":"https://coincentral.com/radiant-capital-hacker-launders-10-8m-through-tornado-cash-mixer/","name":"","type":"other","archive_url":"http://web.archive.org/web/20251027041147/https://coincentral.com/radiant-capital-hacker-launders-10-8m-through-tornado-cash-mixer/","credibility":3,"archive_timestamp":"2025-10-27T04:11:47+00:00"},{"url":"https://crypto.news/radiant-capital-hack-funds-shift-as-13m-in-eth-swapped-for-dai/","name":"","type":"other","archive_url":"http://web.archive.org/web/20250909035324/https://crypto.news/radiant-capital-hack-funds-shift-as-13m-in-eth-swapped-for-dai/","credibility":3,"archive_timestamp":"2025-09-09T03:53:24+00:00"},{"url":"https://news.shib.io/2024/10/24/radiant-capital-hacker-transfers-52m-in-stolen-funds-to-ethereum/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260311221811/https://news.shib.io/2024/10/24/radiant-capital-hacker-transfers-52m-in-stolen-funds-to-ethereum/","credibility":3,"archive_timestamp":"2026-03-11T22:18:11+00:00"},{"url":"https://crypto.news/radiant-capital-hacker-doubles-funds-eth-trading-2025/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260312225005/https://crypto.news/radiant-capital-hacker-doubles-funds-eth-trading-2025/","credibility":3,"archive_timestamp":"2026-03-12T22:50:05+00:00"},{"url":"https://www.coindesk.com/tech/2024/12/09/radiant-capital-says-north-korean-hackers-behind-50-million-attack-in-october","name":"","type":"other","archive_url":"http://web.archive.org/web/20250922201844/https://www.coindesk.com/tech/2024/12/09/radiant-capital-says-north-korean-hackers-behind-50-million-attack-in-october","credibility":3,"archive_timestamp":"2025-09-22T20:18:44+00:00"},{"url":"https://www.bleepingcomputer.com/news/security/radiant-links-50-million-crypto-heist-to-north-korean-hackers/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260410185850/https://www.bleepingcomputer.com/news/security/radiant-links-50-million-crypto-heist-to-north-korean-hackers/","credibility":3,"archive_timestamp":"2026-04-10T18:58:50+00:00"},{"url":"https://www.securityweek.com/radiant-capital-50-million-heist-blamed-on-north-korean-hackers/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260305075602/https://www.securityweek.com/radiant-capital-50-million-heist-blamed-on-north-korean-hackers/","credibility":3,"archive_timestamp":"2026-03-05T07:56:02+00:00"},{"url":"https://beincrypto.com/north-korea-radiant-capital-hack/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260211072228/https://beincrypto.com/north-korea-radiant-capital-hack/","credibility":3,"archive_timestamp":"2026-02-11T07:22:28+00:00"},{"url":"https://cryptoslate.com/radiant-capital-teams-with-us-law-enforcement-after-50m-defi-hack/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260725120902/https://cryptoslate.com/radiant-capital-teams-with-us-law-enforcement-after-50m-defi-hack/","credibility":3,"archive_timestamp":"2026-07-25T12:09:02+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:36.075683+00:00","updated_at":"2026-09-01T07:15:37.935663+00:00"}}