Radiant Capital: Hacked in January, Fixed Everything, Then Hacked Again for $53M in October

Radiant Capital was hacked twice in 2024. The first time, on 2 January, cost about $4.5 million and was, by the standards of decentralized finance, unremarkable. The team paused its markets, published a post-mortem and tightened its procedures. Ten months later, on 16 October, it lost roughly $50 million to $53 million to an attack that walked straight past all of it. Twenty months after that, Radiant gave up.

Radiant was a lending protocol: a set of smart contracts, code that moves money by itself, that let people deposit crypto to earn interest and borrow against it, like a bank's lending desk with no staff. It ran on several blockchains, including Arbitrum and BNB Chain, and at its peak held more than $300 million in deposits.

The first hack: six seconds

The January attack was a known trick. Radiant had just opened a new market for USDC, a stablecoin pegged to the US dollar, on Arbitrum. Six seconds after it went live, while the market was still empty, an attacker used a flash loan, a huge loan borrowed and repaid within a single transaction, to inflate the market's internal accounting and exploit a rounding error in the maths. About 1,900 ether, worth around $4.5 million, left the protocol. Security firms pointed out that the flaw was an old one in lending code copied from Aave and Compound, and that Aave had long avoided it by seeding every new market with a deposit so it was never empty.

Three keys out of eleven

The October attack went after people, not code. Changes to Radiant's core contracts needed approval from a multisig, a shared account that acts only when enough of its key holders sign, like a company cheque that needs several directors' signatures. Radiant's had eleven signers and needed three.

On 11 September 2024, according to Radiant's own account, one of its developers received a Telegram message from someone posing as a former contractor. The contractor said they were moving into smart contract auditing and wanted feedback on a report, sent as a zipped PDF. The developer opened it and shared it with colleagues. The PDF looked real. Inside the zip was malware later named INLETDRIFT, which installed a hidden backdoor on the developers' Apple Mac computers.

For five weeks the attackers waited. When signers sat down to approve routine transactions in the Safe wallet interface, the malware showed them normal transaction details while quietly swapping in malicious ones to be signed in the background. Radiant said its usual checks, including simulations of each transaction before signing, showed nothing wrong. Several people approved what they believed was ordinary housekeeping on their own hardware wallets. What they actually signed handed ownership of Radiant's lending pool contracts on Arbitrum and BNB Chain to the attacker.

On 16 October the attacker used that control to replace the contracts with their own version and drain them, including funds from users who had given Radiant's contracts permission to move their tokens. Arkham Intelligence was among the first to flag the theft. Radiant paused its markets. Its deployments on Ethereum and Base were not touched.

North Korea, again

Radiant hired Mandiant, the incident response firm owned by Google, to examine the infected machines. On 6 December 2024 Radiant published Mandiant's conclusion: the attack was carried out by UNC4736, a group Mandiant assessed with high confidence works for North Korea. The group is also tracked as AppleJeus and Citrine Sleet, and Mandiant had previously tied it to the 3CX software supply-chain attack of 2023. Radiant was also reported to be working with the FBI.

The pattern matched other North Korean thefts of that period. In July 2024, signers at the Indian exchange WazirX approved a transaction that did not match what their screens showed, and lost $235 million. In February 2025, the same trick, carried out through a compromised developer machine at the Safe wallet company, took $1.5 billion from Bybit. Each time the cryptography held and the multisig worked as designed. Real people with real keys approved transactions they had not actually been shown.

In April 2026 Drift Protocol, a Solana trading exchange, was drained of between $270 million and $295 million, depending on the count, after a six-month social engineering operation. Drift said on-chain fund flows linked the attack to wallets from the Radiant exploit, and attributed it, with medium-high confidence, to the same group.

Where the money went

The attacker did not rush. Most of the stolen funds were converted into ether and held. As the price of ether rose, the haul grew: in 2025 the blockchain analytics account Lookonchain reported the attacker's wallets held 21,957 ETH, worth about $103 million at the time, close to double the value stolen. In August 2025 the security firm PeckShield flagged the attacker swapping 3,091 ETH for $13.26 million of DAI, a dollar-pegged stablecoin, and moving it to new addresses, later buying ether back on price dips. CertiK tracked about $10.8 million worth of ether through Tornado Cash, a mixing service used to hide where coins came from. None of the money has been recovered.

The wind-down

Radiant tried to carry on for another year and a half, but it never recovered the stolen money, never found new investors and never won back its depositors. On 1 June 2026 Radiant announced that it would stop operating. "The DAO no longer has a viable path forward," it said, citing the lack of any meaningful recovery of stolen funds, new capital or growth. The protocol moved into a maintenance state: its website and contracts stay up so users can withdraw and repay, borrowing caps are cut to zero, RDNT token rewards stop, and development ends. Radiant said any funds ever recovered would go to affected users. By then the protocol held about $2.2 million, less than one per cent of its peak.