2024-10-17
Radiant Capital, a prominent cross-chain lending protocol, has suffered a significant exploit that drained $58 million from its platform, according to Web3 cybersecurity firm De.Fi Antivirus revealed on October 16. The breach occurred across multiple chains, affecting both Binance Chain (BNB) and Arbitrum network.
The exploit was also reported by blockchain security firm Ancilia Inc., which reported suspicious activity on Radiant's smart contract on BNB Chain in a post on X. Ancilia identified several on-chain transactions showing that at least $16 million had been drained from the protocol on BNB.
Shortly afterward, assets were also siphoned from Radiant’s lending pools on Arbitrum, an Ethereum layer-2 network. Hacken, another security firm, estimated that around $50 million worth of digital assets, including USDT, USDC, and ARB tokens, were stolen.
Radiant Capital confirmed the issue on
X "We are aware of an issue with the Radiant Lending markets on Binance
Chain and Arbitrum," the protocol stated. As a precaution, Radiant paused
its lending markets on both Ethereum and the layer-2 Base network, urging users
to revoke permissions to affected smart contracts via a Revoke.Cash tool.
The attack is believed to have occurred after the hacker obtained three of the 11 private keys required to control Radiant’s smart contracts, allowing them to upgrade and exploit the platform. Web3 security firm De.Fi explained that the hacker used the ‘transferFrom’ function to drain users' funds, including USDC, WBNB, and ETH tokens.
This is the second attack Radiant has
faced this year, following a $4.5 million hack in January due to a bug in its
smart contracts.
While details on how the private keys
were compromised remain unclear, some in the Ethereum security community
speculated that the breach may have stemmed from a compromised front-end,
potentially tricking legitimate key-holders into interacting with malicious
software.
Radiant, governed by a decentralized
autonomous organization (DAO), said it is working with various security firms,
including SEAL911, Hypernative, ZeroShadow, and Chainalysis, to investigate the
attack and ensure user protection. However, the full impact and recovery steps
are yet to be determined.
The incident highlights ongoing
security challenges in decentralized finance (DeFi), where protocols often rely
on multisignature wallets (multisigs) to secure platforms. While multisigs are
popular for their added security, they have become targets for attackers
seeking to exploit centralized control points.
Radiant's mission to "unify
fragmented liquidity across Web3 money markets" has been severely tested
by this breach, with the protocol’s future security measures now under intense
scrutiny.
