Radiant Capital, a cross-chain lending protocol, published a detailed post‑mortem on a major October 16, 2024 security incident in which attackers stole over $50 million in crypto assets and forced the protocol to pause operations. The investigation found that the core issue was not a smart contract bug but a targeted compromise of contributors’ devices and private keys, which allowed the attacker to control enough signers on Radiant’s 11‑member multisig to execute malicious upgrades and drain funds from lending pools on Arbitrum and BNB Chain. Developers were using hardware wallets and were geographically distributed, indicating a coordinated malware‑based campaign rather than physical coercion. The incident followed a separate ~$4.5 million flash‑loan‑related exploit earlier in the year, making this Radiant’s second major security failure in 2024. According to the post‑mortem and external technical analyses, the attacker first gained control of at least 3 of 11 multisig signers, which was the threshold required to authorize upgrades. With that control, they transferred ownership of Radiant’s pool provider contracts to a malicious implementation, upgraded the proxy logic, and then drained assets including USDC, USDT/BUSDT, BTCB, wBETH, wBNB, and ETH from user pools. Radiant coordinated with blockchain security firms, paused markets on impacted networks, and engaged U.S. law enforcement and the FBI to trace funds and investigate the malware and key compromise. The post‑mortem emphasizes operational security lessons for DeFi teams, including the risks of low multisig thresholds, the need for hardened key management and device security, continuous monitoring of admin actions, and defense‑in‑depth for multi‑chain treasury and governance controls.

AI-generated background, compiled from web sources — not editorial content.

More coverage

Explore the topic

More on Hacks

Ethereum loses $459M in 34 H1 incidents; one Drift Trade hack accounts for $295M of Solana's five-incident $328M total

Ethereum loses $459M in 34 H1 incidents; one Drift Trade hack accounts for $295M of Solana's five-incident $328M total

Quillaudits ·

Crypto hacks hit $75.9M across 40 June attacks as losses dip 7% from May

Crypto hacks hit $75.9M across 40 June attacks as losses dip 7% from May

𝕏/@TheBlockCo ·

Crypto hacks hit record 83 incidents in Q2 as bridges account for $351M of $755M stolen

Crypto hacks hit record 83 incidents in Q2 as bridges account for $351M of $755M stolen

CoinTelegraph ·

Humanity Protocol's 447M H token attack wasn't a hack—it was operational security FAIL: malware on a dev machine gave attackers full root access to 7 private keys, draining $31M+ because devs backed up keys to the wrong device during mainnet launch

Humanity Protocol's 447M H token attack wasn't a hack—it was operational security FAIL: malware on a dev machine gave attackers full root access to 7 private keys, draining $31M+ because devs backed up keys to the wrong device during mainnet launch

humanityprotocol.notion.site ·

a16z’s Eddy Lazzarin says crypto hacks appear worse because blockchain transparency exposes exact losses instantly, while TradFi breaches often bury the true scale of damage

a16z’s Eddy Lazzarin says crypto hacks appear worse because blockchain transparency exposes exact losses instantly, while TradFi breaches often bury the true scale of damage

𝕏/@a16zcrypto ·

New research argues modern DeFi lending markets are far safer than their reputation suggests, with exploit losses now heavily concentrated in isolated edge cases

New research argues modern DeFi lending markets are far safer than their reputation suggests, with exploit losses now heavily concentrated in isolated edge cases

𝕏/@flipdazed ·

Explore the full feed

Comments

Up nextBinance founder CZ warns acquiring small crypto exchanges poses hidden security risks after BitMEX and BitMart shut down.