Radiant Capital appears to suffer $51 million exploit on its BNB Chain and Arbitrum instances

Omnichain money market Radiant Capital RDNT -7.43% seems to be undergoing an exploit, according to onchain evidence and Web3 security Ancilia. The attack began Wednesday afternoon on Radiant’s Ethereum ETH +1.04% Layer 2 Arbitrum ARB -0.78% instance and then moved onto BNB +1.39% Chain, according to Arkham Intelligence data .  

“We have noticed several transferFrom user's account through the contract 0xd50cf00b6e600dd036ba8ef475677d816d6c4281. Please revoke your approval ASAP. It seems like the new implementation had vulnerability functions,” Ancilia wrote on X . 

A transferFrom exploit uses a smart contract’s transferFrom function to enable one account to send a specified number of tokens from a target account to a third account. It generally requires the victim’s account to grant permission to interact with a spoofed wallet address. Ancilia is warning Radiant users to revoke all Radiant contract addresses as a safety measure.

"Radiant capital has fallen victim to a hack causing $51mm in losses so far across Arbitrum and BnB chain. The Ethereum and Base deployments seem to be secure but we would warn anyone to be careful interacting with these contracts at this time," Tony Ke, security research lead at Fuzzland, told The Block in an interview.

According to Ancilia, a backdoor contract was deployed at approximately 17:09 UTC on Wednesday, enabling the unknown attacker to gain unauthorized access and begin transferring tokens. 

"Radiant leverages a multisig setup for their smart contract controls which seems to have been compromised internally," Ke said. The attack profile suggests that someone was either phished or there was a compromised computer or an inside attacker that led to Radiant's private keys leaking. 

"As we learn more information about how this occurred, we will try to work in conjuction with the Radiant team to help in any fund recovery efforts possible," Ke said.

The hacker transferred wrapped versions of BNB, ETH, USDC and USDT tokens, among others, from a Radiant-controlled wallet to a single address beginning 0x0629b. That wallet currently has a BNB balance of over $5 million worth of tokens. That same wallet’s account on DeBank shows a $51 million balance , with a 2,619,512.54% increase in token holdings since it was created, indicating the attack could be far more widespread.

The attacker’s address holds over $32 million worth of Arbitrum-based assets and around $18 million worth of tokens on BNB Chain. Its largest holdings are ETH derivatives wstETH and weETH. 

Earlier this year, Radiant Capital lost around 1900 ETH, worth $4.5 million, in a flash loan attack. 

Editor's note: Adds context about the hack and quotes from Fuzzland's Tony Ke.