Radiant V2
Last changed 2026-10-10 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 10 → 54. Problems weighed by who is responsible: incidents the subject suffered −16, problems around the subject, caused by others −0.8; legitimacy credit long-running +6. Version history →
Why this score
| Every page starts at | 65 |
| Incidents it suffered (e.g. hacks) | -16 |
| Problems around it, caused by others | -0.8 |
| Long-running | +6 |
| Sum | 54 |
Score: 54/100 (kept between 0 and 100)
How scoring works →Summary
Radiant Capital is a decentralized cross-chain lending protocol built on LayerZero that suffered two significant security incidents in 2024: a $4.5 million flash loan exploit in January 2024 and a far more devastating $50 million multisig compromise in October 2024. The October hack, attributed by Mandiant with high confidence to North Korean state-sponsored group UNC4736 (Citrine Sleet / AppleJeus), involved a months-long social engineering campaign, macOS malware deployment on developer devices, and manipulation of hardware wallet signing interfaces to drain funds across BNB Chain and Arbitrum.
Connected Entities
9 entities · 60 linked investigations- Safe{Wallet}→mentioned with→Ethereum(80%)
- Safe{Wallet}→mentioned with→Arbitrum(60%)
- Binance→mentioned with→Ethereum(65%)
- SushiSwap→mentioned with→Arbitrum(65%)
- SushiSwap→mentioned with→Ethereum(60%)
- LayerZero — DVN Single-Verifier Configuration Risk→mentioned with→Ethereum(60%)
- Radiant V2→mentioned with→SushiSwap(65%)
- Radiant V2→mentioned with→Binance(70%)
- Radiant V2→mentioned with→LayerZero — DVN Single-Verifier Configuration Risk(70%)
- Radiant V2→mentioned with→Citrine Sleet / AppleJeus(80%)
- + 11 more
Timeline(11 events)
July 2022
Radiant Capital launches RDNT token on Arbitrum via Sushiswap fair launch.
2 January 2024
Flash loan exploit drains $4.5 million ETH from newly activated USDC market on Arbitrum via rounding error in liquidityIndex calculation.
3 January 2024
Radiant pauses Arbitrum lending and borrowing markets; promises post-mortem and user repayment.
11 September 2024
North Korean UNC4736 attacker sends malicious Telegram message to Radiant developer, impersonating a former contractor; INLETDRIFT macOS malware deployed via ZIP file.
16 October 2024
Attackers exploit compromised hardware wallets of at least 3 of 11 multisig signers to execute transferOwnership() on LendingPoolAddressesProvider; approximately $50–53 million drained from BSC and Arbitrum markets. Backdoor removed within 3 minutes of theft.
17 October 2024
Radiant publishes initial post-mortem; engages Mandiant, zeroShadow, Hypernative, and SEAL 911.
24 October 2024
On-chain tracking confirms hacker bridges $52M in stolen funds to Ethereum.
6 December 2024
Radiant Capital publishes updated incident report attributing attack to UNC4736 (North Korea) based on Mandiant forensic analysis.
9 December 2024
Public attribution of attack to DPRK-linked UNC4736 / Citrine Sleet / AppleJeus group reported by major media.
August 2025
On-chain monitors observe hacker actively trading stolen ETH and DAI; stolen portfolio value reportedly grows from $53M to over $94M through ETH appreciation and active arbitrage.
October 2025
Hacker deposits 2,834.6 ETH (approximately $10.8M) into sanctioned mixer Tornado Cash, substantially reducing recovery prospects.
Decision Log
- slot 455368980 · hash 8rRHDQbo3x7ka5Zfq15D7VW9HPU5M68UrRqWHKfUaejY
- slot 420848175 · hash BBbf816uKC6jCkXMQW8B5FdyEjogoa3q2hQQL8kXevP4
This investigation is cryptographically anchored to the Solana blockchain (2 decisions). 18 of 19 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:36 AM
last updated: 10/10/2026, 6:49:00 PM
5 viewsavoid.net — verified advice for a post-truth world