Audit log

Every state-changing event for Radiant V2: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-19 21:12:24Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 420,848,175

   sig

   39AwoPtH4Y1Q…m7XjkKytcopyexplorer ↗

   hash

   BBbf816uKC6j…L8kXevP4copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (6214 B) ▸

   {"actor":"system:backfill","investigation_id":"7d00d907-ddca-4513-9bdc-f3e52a5766e5","kind":"publish","page_slug":"radiant-v2","published_at":"2026-05-19T21:12:24.558Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Radiant V2","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.nansen.ai/post/what-is-radiant-capital-cross-chain-defi-explained"},{"credibility":3,"name":"","type":"other","url":"https://www.datawallet.com/crypto/radiant-capital-explained"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://medium.com/@RadiantCapital/radiant-capital-incident-update-e56d8c23829e"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-radiant-capital-hack-october-2024"},{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/tech/2024/10/16/radiant-capital-loses-50m-to-blockchain-exploit"},{"credibility":3,"name":"","type":"other","url":"https://decrypt.co/287162/radiant-capitals-50m-breach-among-most-sophisticated-hacks-in-defi-history"},{"credibility":3,"name":"","type":"other","url":"https://medium.com/@RadiantCapital/radiant-post-mortem-fecd6cd38081"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/radiant-capital-lending-protocol-flash-loan-attack-arbitrum"},{"credibility":3,"name":"","type":"other","url":"https://www.cryptopolitan.com/radiant-capital-repayment-flash-loan-exploit/"},{"credibility":3,"name":"","type":"other","url":"https://blog.quillaudits.com/trending/radiant-capital-hack-analysis/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://coincentral.com/radiant-capital-hacker-launders-10-8m-through-tornado-cash-mixer/"},{"credibility":3,"name":"","type":"other","url":"https://crypto.news/radiant-capital-hack-funds-shift-as-13m-in-eth-swapped-for-dai/"},{"credibility":3,"name":"","type":"other","url":"https://news.shib.io/2024/10/24/radiant-capital-hacker-transfers-52m-in-stolen-funds-to-ethereum/"},{"credibility":3,"name":"","type":"other","url":"https://crypto.news/radiant-capital-hacker-doubles-funds-eth-trading-2025/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/tech/2024/12/09/radiant-capital-says-north-korean-hackers-behind-50-million-attack-in-october"},{"credibility":3,"name":"","type":"other","url":"https://www.bleepingcomputer.com/news/security/radiant-links-50-million-crypto-heist-to-north-korean-hackers/"},{"credibility":3,"name":"","type":"other","url":"https://www.securityweek.com/radiant-capital-50-million-heist-blamed-on-north-korean-hackers/"},{"credibility":3,"name":"","type":"other","url":"https://beincrypto.com/north-korea-radiant-capital-hack/"},{"credibility":3,"name":"","type":"other","url":"https://medium.com/@RadiantCapital/radiant-capital-incident-update-e56d8c23829e"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-radiant-capital-hack-october-2024"},{"credibility":3,"name":"","type":"other","url":"https://cryptoslate.com/radiant-capital-teams-with-us-law-enforcement-after-50m-defi-hack/"},{"credibility":3,"name":"","type":"other","url":"https://coincentral.com/radiant-capital-hacker-launders-10-8m-through-tornado-cash-mixer/"}]}],"sources_used":[],"summary":"Radiant Capital is a decentralized cross-chain lending protocol built on LayerZero that suffered two significant security incidents in 2024: a $4.5 million flash loan exploit in January 2024 and a far more devastating $50 million multisig compromise in October 2024. The October hack, attributed by Mandiant with high confidence to North Korean state-sponsored group UNC4736 (Citrine Sleet / AppleJeus), involved a months-long social engineering campaign, macOS malware deployment on developer devices, and manipulation of hardware wallet signing interfaces to drain funds across BNB Chain and Arbitrum.","timeline":[{"date":"2022-07-01","event":"Radiant Capital launches RDNT token on Arbitrum via Sushiswap fair launch.","source":""},{"date":"2024-01-02","event":"Flash loan exploit drains $4.5 million ETH from newly activated USDC market on Arbitrum via rounding error in liquidityIndex calculation.","source":""},{"date":"2024-01-03","event":"Radiant pauses Arbitrum lending and borrowing markets; promises post-mortem and user repayment.","source":""},{"date":"2024-09-11","event":"North Korean UNC4736 attacker sends malicious Telegram message to Radiant developer, impersonating a former contractor; INLETDRIFT macOS malware deployed via ZIP file.","source":""},{"date":"2024-10-16","event":"Attackers exploit compromised hardware wallets of at least 3 of 11 multisig signers to execute transferOwnership() on LendingPoolAddressesProvider; approximately $50–53 million drained from BSC and Arbitrum markets. Backdoor removed within 3 minutes of theft.","source":""},{"date":"2024-10-17","event":"Radiant publishes initial post-mortem; engages Mandiant, zeroShadow, Hypernative, and SEAL 911.","source":""},{"date":"2024-10-24","event":"On-chain tracking confirms hacker bridges $52M in stolen funds to Ethereum.","source":""},{"date":"2024-12-06","event":"Radiant Capital publishes updated incident report attributing attack to UNC4736 (North Korea) based on Mandiant forensic analysis.","source":""},{"date":"2024-12-09","event":"Public attribution of attack to DPRK-linked UNC4736 / Citrine Sleet / AppleJeus group reported by major media.","source":""},{"date":"2025-08-01","event":"On-chain monitors observe hacker actively trading stolen ETH and DAI; stolen portfolio value reportedly grows from $53M to over $94M through ETH appreciation and active arbitrage.","source":""},{"date":"2025-10-01","event":"Hacker deposits 2,834.6 ETH (approximately $10.8M) into sanctioned mixer Tornado Cash, substantially reducing recovery prospects.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision c9836dd6-a508-4ed4-aea3-6ce6c7c6822ccopy
2. #2rescoreby systemsystem

   2026-10-10 18:49:00Z
   Score: 10 → 54 (+44)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 10 → 54. Problems weighed by who is responsible: incidents the subject suffered −16, problems around the subject, caused by others −0.8; legitimacy credit long-running +6.
   anchoranchored

   chain

   ●mainnet-betaslot 455,368,980

   sig

   2xSJ4w8k9NqX…G2uK2Du4copyexplorer ↗

   hash

   8rRHDQbo3x7k…HKfUaejYcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (606 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:49:00.251Z","decision":"rescore","investigation_id":"7d00d907-ddca-4513-9bdc-f3e52a5766e5","new_score":54,"page_slug":"radiant-v2","prev_score":10,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 10 → 54. Problems weighed by who is responsible: incidents the subject suffered −16, problems around the subject, caused by others −0.8; legitimacy credit long-running +6.","score_delta":44,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ac2a733f-1d83-408a-a719-3fb51d875b1ccopy
3. #3reviewby reviewerreviewer

   2026-11-02 00:46:35Z
   Score: 54 → 54 (no score change)
   The core incident facts hold: the Jan 2024 exploit, the Oct 16, 2024 multisig compromise on BSC and Arbitrum, the 3-of-11 threshold, and the Dec 2024 UNC4736 attribution. The page omits the June 2026 wind-down announcement, which is critical and makes some wording stale. Some granular technical details could not be checked because Radiant's primary posts were blocked, and 'sanctioned' for Tornado Cash may be outdated. Only a sample of claims was checked.
   anchoranchored

   chain

   ●mainnet-betaslot 464,298,852

   sig

   5XDGJg9kY7KN…97YDnXAacopyexplorer ↗

   hash

   AadxYrJSKb8J…szqYqu64copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1343 B) ▸

   {"actor":"reviewer","artifact_identity":"30b72a3838576f6d81773288fb7e1de5","blocked_count":1,"decided_at":"2026-11-02T00:46:35.526Z","decision":"review","disputed_pct":0.1429,"findings_hash":"ECuh1AKsfN6dBMabfghCXTfmg3TK1beVft9CectVswNx","investigation_id":"7d00d907-ddca-4513-9bdc-f3e52a5766e5","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":54,"omissions":{"material":1,"total":1},"page_content_hash":"751e445d8dbcd32e997f3ccf6c705f9121313d1f3cf735897dc5c79382851201","page_slug":"radiant-v2","prev_score":54,"reason":"The core incident facts hold: the Jan 2024 exploit, the Oct 16, 2024 multisig compromise on BSC and Arbitrum, the 3-of-11 threshold, and the Dec 2024 UNC4736 attribution. The page omits the June 2026 wind-down announcement, which is critical and makes some wording stale. Some granular technical details could not be checked because Radiant's primary posts were blocked, and 'sanctioned' for Tornado Cash may be outdated. Only a sample of claims was checked.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":7,"sequence_num":3,"subject_status":"shut_down","subject_status_contradicts_page":true,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 40e419c0-d2b9-4f96-818b-d0eeffc7f09dcopy
4. #4review reviseby judgejudge

   2026-11-02 00:46:35Z
   Score: 54 → 54 (no score change)
   The core incident facts hold up: the October 2024 multisig compromise, the 3-of-11 threshold, the chains affected, the January 2024 exploit and the December 2024 attribution to UNC4736 were confirmed (claim_findings[0], [1], [4]). Of the 7 claims that could be checked, 1 could not be verified (the Tornado Cash deposit, claim_findings[7]), which is about 14% and would normally mean minor issues; one more unverifiable claim was excluded because the source blocked the reviewer. However, the page omits that the Radiant DAO announced a wind-down on June 1, 2026 (omission_findings[0], subject_status), which makes the 'normal operations resumed' and 'as of 2026' wording stale (claim_findings[5], [6]). Because this is a critical omission about the subject's current status, the verdict is revised more heavily than the percentage alone implies.
   anchoranchored

   chain

   ●mainnet-betaslot 464,298,857

   sig

   5yN4odyT3kxo…AoqVJKAFcopyexplorer ↗

   hash

   5RDDHzfv1gfm…8vs1RqdZcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1927 B) ▸

   {"actor":"judge","artifact_identity":"30b72a3838576f6d81773288fb7e1de5","band_override":null,"blocked_count":1,"decided_at":"2026-11-02T00:46:35.526Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.1429,"investigation_id":"7d00d907-ddca-4513-9bdc-f3e52a5766e5","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":54,"page_slug":"radiant-v2","prev_score":54,"reason":"The core incident facts hold up: the October 2024 multisig compromise, the 3-of-11 threshold, the chains affected, the January 2024 exploit and the December 2024 attribution to UNC4736 were confirmed (claim_findings[0], [1], [4]). Of the 7 claims that could be checked, 1 could not be verified (the Tornado Cash deposit, claim_findings[7]), which is about 14% and would normally mean minor issues; one more unverifiable claim was excluded because the source blocked the reviewer. However, the page omits that the Radiant DAO announced a wind-down on June 1, 2026 (omission_findings[0], subject_status), which makes the 'normal operations resumed' and 'as of 2026' wording stale (claim_findings[5], [6]). Because this is a critical omission about the subject's current status, the verdict is revised more heavily than the percentage alone implies.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":7,"sequence_num":4,"severity_override":{"applied":true,"band":"significant","from_band":"minor","reason":"The review reports a critical omission (omission_findings[0]) and subject_status.contradicts_page is true: the Radiant DAO announced a wind-down on June 1, 2026 and the page never mentions it. The claim percentage alone (about 14%, minor band) understates this, so the page is judged under the significant band."},"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 086522f4-688a-4fad-988d-ac7f7f309fcacopy
5. #5rescoreby systemsystem

   2026-11-02 00:46:36Z
   Score: 54 → 57 (+3)
   Recalculated after the fact-check of 2026-11-02. Rescored under Scoring v2, the published formula (avoid.net/scoring): 54 → 57. Problems weighed by who is responsible: incidents the subject suffered −12.8, problems around the subject, caused by others −0.8; legitimacy credit long-running +6; 1 section(s) set aside until a failed fact-check is resolved.
   anchoranchored

   chain

   ●mainnet-betaslot 464,298,863

   sig

   3EmQVVFcA1Jg…RdGxChbgcopyexplorer ↗

   hash

   BqCyKkCyGQBP…MNAsJQkUcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (718 B) ▸

   {"actor":"system","decided_at":"2026-11-02T00:46:35.526Z","decision":"rescore","investigation_id":"7d00d907-ddca-4513-9bdc-f3e52a5766e5","new_score":57,"page_slug":"radiant-v2","prev_score":54,"reason":"Recalculated after the fact-check of 2026-11-02. Rescored under Scoring v2, the published formula (avoid.net/scoring): 54 → 57. Problems weighed by who is responsible: incidents the subject suffered −12.8, problems around the subject, caused by others −0.8; legitimacy credit long-running +6; 1 section(s) set aside until a failed fact-check is resolved.","score_delta":3,"score_model":"v2","sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 8e46cd14-b41e-40df-9121-c79854705529copy