Radiant Capital Got Hacked in January, Fixed Everything, and Got Hacked Again in October

Eleven signers controlled Radiant Capital's multisig. The attacker only needed three, and they got them by compromising developer machines so cleanly that the malicious transactions passed every review the team ran.

Radiant Capital was robbed in January 2024, hardened its security, and was robbed again in October.

Radiant Capital was hacked twice in 2024. The January incident cost about $4.5 million and was, by the standards of DeFi, unremarkable. The team responded the way you would want: audited, hardened, reviewed the multisig arrangements. Ten months later they lost roughly $53 million to an attack that walked straight past all of it.

Radiant's governance ran on an eleven-signer multisig. Changing the protocol's core contracts required a quorum of those signers to approve, which is a sensible arrangement and considerably more distributed than most of DeFi. On October 16, 2024, an attacker got control of three of those eleven private keys and used them to take control of the smart contracts.

The interesting question is how three of eleven was enough, and the answer is that the quorum threshold was lower than the total, as it always is. Eleven signers does not mean eleven approvals. It means a group large enough that no small number of compromises should be able to move anything, which is a reasonable design right up until somebody compromises exactly the small number required.

The compromise itself was the sophisticated part. This was not phishing a signer into clicking a link. The attacker gained access to developer machines and manipulated what the signing devices displayed, so the transactions the signers reviewed and approved appeared legitimate at every stage. Multiple people looked at malicious payloads through their own hardware wallets and saw normal operations. Security firms who examined it described the malware and the process as unusually advanced.

Analysts linked the attack to North Korea. As with WazirX three months earlier, the pattern is state-level patience applied to the human review layer rather than the cryptography.

Two things about this entry are worth carrying into everything else in the database. The first is that being hacked and then fixing your security does not inoculate you. Radiant did the remediation work after January and it was irrelevant, because the second attack came through an entirely different layer. Fixing the thing that broke last time protects you from last time.

The second is that this is the same failure as WazirX and, later, as Bybit in February 2025: the signer's screen lied. Three separate incidents across thirteen months, hundreds of millions of dollars, all resolving to the same sentence. The cryptography held every time. The multisig quorums functioned as designed every time. Real humans with real keys gave real approvals to transactions that were not the transactions they had been shown.

The funds were not recovered. Nobody has been arrested. Radiant paused its markets, and the protocol never regained the position it held before.