Radiant Capital Suffers $50M Exploit Across BNB Chain and Arbitrum
Radiant Capital, a decentralized lending protocol, has experienced a significant cyberattack, resulting in the loss of over $50 million in digital assets. The breach occurred across Binance’s BNB Chain and Ethereum’s layer-2 Arbitrum network, marking the second major exploit the platform has faced this year. This raises further concerns about the security of decentralized finance (DeFi) platforms.
The Incident Unfolds
The attack was initially reported on Wednesday by blockchain security firm Ancilia Inc., which identified suspicious activity involving Radiant Capital’s smart contracts on BNB Chain. Early reports indicated that around $16 million had been drained from the platform on BNB. Shortly after, assets were siphoned from Radiant’s liquidity pools on Arbitrum. Another security firm, Hacken, confirmed the total stolen assets, including USDT, USDC, and ARB, amounted to nearly $50 million.
Radiant Capital addressed the issue on X (formerly Twitter), stating, “We are aware of an issue with the Radiant Lending markets on Binance Chain and Arbitrum.” The platform assured users they were collaborating with blockchain security teams SEAL911, Hypernative, ZeroShadow, and Chainalysis to investigate the breach.
How the Attack Happened
According to Web3 security firm De.Fi, the attackers exploited Radiant’s smart contracts through the ‘transferFrom’ function, which allowed them to drain user funds. Radiant operates with a multi-signature (multisig) wallet system, requiring 11 signers to authorize protocol upgrades. The attackers managed to gain control of three private keys, providing enough access to modify the smart contracts and execute the attack.
While the exact method of compromising the private keys remains unclear, some Ethereum security experts speculate that a front-end attack may have been used. In such an exploit, legitimate key-holders might have been tricked into interacting with a malicious interface, giving the attackers control.
In response, Radiant paused its markets on Ethereum and the layer-2 network Base, urging users to revoke smart contract permissions as a precaution. The platform also directed users to Revoke.Cash to check if their accounts were at risk.
Not the First Incident
This attack is not the first time Radiant Capital has been targeted. In January, the protocol lost $4.5 million in a flash loan-based exploit on Arbitrum due to a bug in its smart contracts. The recurring security breaches highlight the vulnerabilities of DeFi systems, even those designed to be secure and capital-efficient.
The Broader Impact
Radiant Capital operates as a decentralized autonomous organization (DAO) with the goal of unifying fragmented liquidity across Web3’s various money markets into a seamless, omnichain platform. However, repeated security incidents threaten to undermine confidence in Radiant and similar DeFi projects.
These attacks reveal the critical need for more robust security frameworks in DeFi, as hackers continuously exploit weaknesses in decentralized systems. The substantial financial loss from this breach serves as a warning to users engaging with DeFi platforms, emphasizing the risks involved.
Conclusion
The $50 million exploit on Radiant Capital has once again shaken the DeFi community, raising serious concerns about the security of blockchain protocols and the safeguarding of user funds. With two major attacks in less than a year, Radiant faces a significant challenge in restoring trust. This incident highlights the urgent need for continuous vigilance and improved security measures in the fast-evolving world of decentralized finance.
- Radiant Capital lost over $50 million in a recent exploit.
- The attack occurred on both BNB Chain and Arbitrum.
- Radiant’s smart contracts were compromised via the ‘transferFrom’ function.
- This is the second major exploit the platform has faced in 2024.
- Radiant is working with blockchain security teams to investigate the breach.
This story is still developing, and Radiant Capital has not yet provided a detailed explanation of how the attackers gained access to the private keys. Until the investigation is complete, users are advised to remain vigilant and take steps to protect their assets.
Ecosystem
Research
News Network
About