$50 Million Radiant Capital Hack Traced to North Korean Cybercriminals
North Korean hackers stole $50 million from Radiant Capital in a sophisticated DeFi heist. This incident exposes critical security gaps in the sector.
On October 16, 2024, Radiant Capital, a decentralized cross-chain lending protocol built on LayerZero, was the victim of a highly sophisticated cyberattack that resulted in a staggering $50 million loss.
The attack has since been linked to North Korean hackers, marking another alarming chapter in the growing wave of cybercrime targeting decentralized finance (DeFi).
Report Links North Korean Actors to Radiant Capital Incident
A report from OneKey, a Coinbase-backed crypto hardware wallet manufacturer, attributed the attack to North Korean hackers. The report extends from a recent medium post shared by Radiant Capital, which provided an incident update on the October 16 attack.
Reportedly, Mandiant, a leading cybersecurity firm, further linked the breach to UNC4736, a DPRK-aligned group also known as AppleJeus or Citrine Sleet. This group operates under the Reconnaissance General Bureau (RGB), North Korea’s primary intelligence agency.
Mandiant’s investigation revealed that the attackers meticulously planned their operation. They staged malicious smart contracts across multiple blockchain networks, including Arbitrum, Binance Smart Chain, Base, and Ethereum. These efforts reflect the advanced capabilities of DPRK-backed threat actors in targeting the DeFi sector.
The breach began with a calculated phishing attack on September 11, 2024. A Radiant Capital developer received a Telegram message from an individual impersonating a trusted contractor. The message included a zip file purportedly containing a smart contract audit report. This file, “Penpie_Hacking_Analysis_Report.zip,” was laced with malware known as INLETDRIFT, a macOS backdoor that facilitated unauthorized access to Radiant’s systems.
When the developer opened the file, it appeared to contain a legitimate PDF. However, the malware silently installed itself, establishing a backdoor connection to a malicious domain at atokyonews[.]com. This allowed the attackers to spread the malware further among Radiant’s team members, gaining deeper access to sensitive systems.
The hackers’ strategy culminated in a man-in-the-middle (MITM) attack. By exploiting compromised devices, they intercepted and manipulated transaction requests within Radiant’s Gnosis Safe Multisig wallets. While transactions appeared legitimate to developers, the malware covertly altered them to execute a transfer Ownership call, seizing control of Radiant’s lending pool contracts.
Execution of the Heist, Industry Implications, and Lessons Learned
Despite Radiant’s adherence to best practices, such as using hardware wallets, transaction simulations, and verification tools, the attackers’ methods bypassed all defenses. Within minutes of securing ownership, the hackers drained funds from Radiant’s lending pools, leaving the platform and its users reeling.
The Radiant Capital hack serves as a stark warning to the DeFi industry. Even projects adhering to rigorous security standards can fall prey to sophisticated threat actors. The incident highlighted critical vulnerabilities, including:
- Phishing Risks: The attack began with a convincing impersonation scheme, emphasizing the need for heightened vigilance against unsolicited file sharing.
- Blind Signing: While essential, hardware wallets often display only basic transaction details, making it difficult for users to detect malicious modifications. Improved hardware-level solutions are necessary to decode and validate transaction payloads.
- Front-End Security: The reliance on front-end interfaces for transaction verification proved inadequate. Spoofed interfaces enabled hackers to manipulate transaction data undetected.
- Governance Weaknesses: The absence of mechanisms to revoke ownership transfers left Radiant’s contracts vulnerable. Implementing time locks or requiring delayed fund transfers could provide critical reaction time in future incidents.
In response to the breach, Radiant Capital has engaged leading cybersecurity firms, including Mandiant, zeroShadow, and Hypernative. These firms assist in the investigation and asset recovery. The Radiant DAO is also collaborating with US law enforcement to trace and freeze stolen funds.
In the Medium post, Radiant also reaffirmed its commitment to sharing lessons learned and enhancing security across the DeFi industry. The DAO emphasized the importance of adopting strong governance frameworks, strengthening device-level security, and moving away from risky practices like blind signing.
“Looks like things could have stopped at step 1,” one user on X commented.
The Radiant Capital incident aligns with a recent report, which indicated how North Korean hackers continue to shift tactics. As cybercriminals grow more sophisticated, the industry must adapt by prioritizing transparency, strong security measures, and collaborative efforts to combat such attacks.
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
Tether’s U.S. Treasury holding approaches record high of $120B
Share link:In this post: Today, Tether published its Q1 2025 attestation report prepared by BDO, confirming total exposure in U.S. Treasuries approaching $120B. Tether also reported over $1B in operating profit from traditional investments during the quarter, driven by solid performance in its U.S. Treasury portfolio. The milestones reinforced the company’s conservative reserve management strategy and highlighted its growing role in distributing dollar-backed liquidity at scale.
Automakers like Ford in solid April sales driven by panic buying amid tariff worries
Share link:In this post: Consumers rushed to buy vehicles on fears of potential price hikes due to the Trump tariffs. While there was strong demand which started in March, this started to wane towards the end of April. For Ford, it reported a 16% sales increase in April.
Arbitrum offers as much as $100k per report to snitch on wasteful DAOs
Share link:In this post: Arbitrum is offering up to $100,000 in ARB tokens to community members who report DAO grant misuse. The “Watchdog” program encourages confidential whistleblowing via the open-source platform, GlobaLeaks. Severity of violations determines the reward, with a funding cap of 400,000 ARB.

Meta, Microsoft earnings beat send stocks higher
Big Tech pulled US indexes back into the green Thursday, as investors waited for two more Mag 7 first-quarter reports after the bell
Trending news
MoreCrypto prices
More








