← Radiant V2reviewed 2026-11-02 · 8 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Radiant V2 against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
unverifiable
2 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #4[unverifiable][awaiting moderator]in the timeline
“North Korean UNC4736 attacker sends malicious Telegram message to Radiant developer, impersonating a former contractor; INLETDRIFT macOS malware deployed via ZIP file.”
reviewerTelegram social engineering started Sept 11, 2024, using INLETDRIFT and the atokyonews[.]com C2 domain.CoinDesk confirms a mid-September phishing message from a fake contractor. The exact date, malware name and domain could not be checked because the primary post was blocked. - #8[unverifiable][awaiting moderator]in the timeline
“Hacker deposits 2,834.6 ETH (approximately $10.8M) into sanctioned mixer Tornado Cash, substantially reducing recovery prospects.”
reviewerExploiter deposited 2,834.6 ETH (about $10.8M) into Tornado Cash in October 2025.Not fetched. Tornado Cash was delisted from OFAC sanctions in March 2025, so 'sanctioned mixer' as a present-tense label may be inaccurate. Needs a check against the primary source.
stale
2 claimsThe claim was accurate when written but events since have overtaken it.
- #6[stale][awaiting moderator]in section: October 2024 Multisig Compromise and North Korea Attribution (~$50 Million)
“The protocol resumed normal operations after the investigation concluded.”
reviewerRadiant is described as a current risk with normal operations resumed, without noting the June 2026 wind-down.Normal operations were later superseded by the wind-down. The correction is additive and the original sentence stays as written.Proposed correction (not yet applied)The protocol resumed normal operations after the investigation concluded. In June 2026 the DAO announced a wind-down and moved the protocol into a maintenance-only state. - #7[stale][awaiting moderator]in section: Protocol Wind-Down and Current Status
“Radiant Capital presents an extreme risk profile for users and depositors as of 2026.”
reviewerRisk assessment framed 'as of 2026' omits that the protocol is winding down.The 'as of 2026' framing misses the most important 2026 development.Proposed correction (not yet applied)Radiant Capital presents an extreme risk profile for users and depositors as of 2026; the DAO announced a wind-down on June 1, 2026 and the protocol is in a maintenance-only state.
partially supported
1 claimThe cited evidence supports part of the claim but not all of it.
- #3[partially supported][awaiting moderator]in section: Post-Hack Fund Recovery and Laundering
“Mandiant's attribution is based on device-level forensic analysis conducted in the weeks following the breach.”
reviewerMandiant's attribution is based on completed device-level forensics, with high confidence.Forensic basis is plausible, but cited coverage is more hedged than the page.
confirmed
3 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: January 2024 Flash Loan Exploit (~$4.5 Million)
“Malicious contracts were deployed across four chains (BSC, Arbitrum, Base, and Ethereum), though only the attacks on BSC and Arbitrum succeeded.”
reviewerRadiant lost about $50-53M on Oct 16, 2024, with malicious contracts deployed on four chains but only BSC and Arbitrum succeeding, via a 3-of-11 multisig.Chains, amount and multisig threshold match the cited sources. - #2[confirmed][no action needed]in section: Post-Hack Fund Recovery and Laundering
“In December 2024, Radiant Capital publicly attributed the October 2024 hack to UNC4736, a North Korean state-sponsored threat actor tracked by Mandiant.”
reviewerRadiant attributed the attack to UNC4736 in December 2024 (report dated Dec 6, media Dec 9), with Mandiant linking it to the RGB.Attribution and dates match. CoinDesk's hedged wording means the summary's 'high confidence' framing is not independently confirmed there. Radiant's own post was blocked (403). - #5[confirmed][no action needed]in section: October 2024 Multisig Compromise and North Korea Attribution (~$50 Million)
“On January 2, 2024, Radiant Capital suffered an earlier, unrelated exploit resulting in the loss of approximately $4.5 million in ETH.”
reviewerJan 2, 2024 flash loan exploit of about $4.5M on Arbitrum.Amount and nature match. The exact day was not independently fetched.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.