Details of the Hack
The exploit specifically targeted Radiant Capital’s BNB and Arbitrum instances, enabling the hackers to drain millions in assets, including:
- Ether (ETH)
- USD Coin (USDC)
- Wrapped BNB (WBNB)
Radiant Loses $51M in Crypto in a Suspected Exploit
Blockchain security firm Ancilia Inc. has confirmed the hack on Radiant Capital, a leading cross-chain lending protocol. Reports indicate that the attacker exploited a vulnerability in the protocol’s transferFrom multi-sig wallet system.
According to data from Arkham Intelligence, the exploit began on Wednesday, targeting the protocol’s Arbitrum instance before extending to the BNB chain.
Mechanics of the Exploit
Radiant Capital employs a multi-signature wallet system called transferFrom to secure and control its smart contracts. The exploit involved compromising the private keys to the multi-sig wallet through this function.
As a result, the hacker gained unauthorized access to multiple user accounts and withdrew funds to another account, transferring tokens from a wallet controlled by Radiant to an address beginning with 0x0629b, which is believed to belong to the hacker.
Hacker’s Wallet Activity
The hacker’s address currently holds:
- Over $32 million in Arbitrum-based tokens
- Approximately $18 million in BNB Chain assets
- More than $5 million in BNB
Additionally, the hacker’s DeBank account shows a balance of $51 million in tokens, reflecting a staggering 2,619,512% increase since its creation.
Security Concerns and Radiant Capital’s Response
In light of the breach, Radiant Capital has suspended its Base and Mainnet markets and is collaborating with blockchain security firms Chainalysis, Hypernative, SEAL911, and ZeroShadow to investigate the incident.
Furthermore, the protocol has allocated $10 million in funds to reimburse affected users and has advised them to cancel all Radiant contract addresses to prevent further exploitation.
Expert Warnings and Future Measures
Fuzzland’s security research lead, Tony Ke, has warned users against interacting with compromised contracts until all potential threats are addressed. His firm is working with Radiant’s team to investigate the breach and explore recovery options for lost funds.
This incident raises concerns about the security of multi-sig wallet systems. The exact cause of the exploit is still under investigation, with some speculating it could involve a front-end compromise or a phishing scam that led private key holders to unknowingly interact with malware.
Criticism and Impact on Radiant Capital
Industry experts have criticized Radiant for its insufficient security measures. Mudit Gupta, chief security officer at Polygon Labs, referred to the incident as a “key management failure.” Despite having eleven signers, the multi-sig wallet only required three signatures to execute transactions.
The exploit has significantly affected the price of Radiant Capital’s native token, RDNT. Over the past 24 hours, RDNT’s price has fallen by more than 11%, currently trading at $0.06429.
Previous Breaches
This is not Radiant Capital’s first security incident. In January, the protocol experienced a flash loan attack that resulted in a loss of about 1900 ETH, valued at $4.5 million.
Ecosystem
Research
News Network
About