Radiant

Radiant Capital

Radiant Capital attackers used malware to hijack developer wallets and swipe over $50 million in assets.
According to Radiant Capital’s post-mortem <a href="https://medium.com/@RadiantCapital/radiant-post-mortem-fecd6cd38081" target="_blank" rel="noopener noreferrer nofollow">report</a>, the attack on Oct. 16, 2024, which led to losses upwards of $50 million, was “one of the most sophisticated hacks ever recorded in DeFi.”
The attackers compromised the <a href="https://crypto.news/australia-federal-police-officer-accused-bitcoin-theft/" target="_blank" rel="noopener noreferrer nofollow">hardware wallets</a> of at least three Radiant developers through a sophisticated malware injection, though it is believed that more devices may have been targeted.&nbsp;
The malware manipulated the front-end interface of Safe{Wallet} (formerly known as Gnosis Safe), displaying legitimate transaction data to the developers while executing malicious transactions in the background.&nbsp;
The attack was executed during a routine multi-signature emissions adjustment process, which takes place periodically to adapt to changing market conditions. Despite multiple layers of verification through Tenderly simulations and manual reviews, no anomalies were detected during the signing process, the report added.
You might also like: <a rel="noopener noreferrer nofollow" href="https://crypto.news/radiant-capital-exploited-for-50m-on-arbitrum-bsc/"> Radiant Capital exploited for $50m on Arbitrum, BSC </a>
The attackers took advantage of Safe App transaction resubmissions, a common occurrence due to issues like gas price fluctuations or network congestion. By mimicking these routine errors, the attackers collected multiple compromised signatures unnoticed, eventually signing the “transferOwnership” function, which transferred control of Radiant’s lending pools to the attackers.
The breach affected Binance Smart Chain (BSC) and Arbitrum, with the attackers using these signatures to alter smart contracts, specifically exploiting the <a href="https://crypto.news/rarible-nft-marketplace-vulnerability-check-point/" target="_blank" rel="noopener noreferrer nofollow">transferFrom function</a> as previously <a href="https://x.com/De_FiSecurity/status/1846624940440572405" target="_blank" rel="noopener noreferrer nofollow">reported</a> by Web3 security firm De.Fi. This allowed them to <a href="https://crypto.news/nearly-75-of-stolen-funds-via-crypto-drainers-funneled-into-defi-in-2023/" target="_blank" rel="noopener noreferrer nofollow">drain assets</a> from users who had granted approval to the lending pools.
Further, the report added that many protocols might be at risk and suggested several preventative measures. These include implementing multi-layer signature verification, using an independent device for verifying transaction data, avoiding blind signing for critical transactions, and setting up error-triggered audits to catch potential issues before signing.
In an Oct. 18 X <a href="https://x.com/danielvf/status/1847023798270206310" target="_blank" rel="noopener noreferrer nofollow">post</a>, Independent programmer Daniel Von Fange noted that the attackers were still draining any assets being transferred to the compromised wallets and advised users to quickly revoke any approvals they had given to the affected contracts to avoid further losses.
<h2 class="wp-block-heading" id="post-hack-measures">Post-hack measures</h2>
Radiant Capital has since <a href="https://crypto.news/radiant-capital-exploited-for-50m-on-arbitrum-bsc/" target="_blank" rel="noopener noreferrer nofollow">paused its lending markets</a> on BNB Chain and Arbitrum. In an Oct. 17 X post, Radiant confirmed it was working with several cybersecurity firms, including SEAL911, Hypernative, and Chainalysis, to investigate the incident and recover the stolen assets.
The lending protocol’s immediate preventive measures include generating fresh cold wallet addresses using uncompromised devices for each member of the Safe, reducing the number of signers to 7, and increasing the signing threshold to 4 out of 7. Further, contributors will also double-confirm transaction data for each transaction using the input data decoder on Etherscan to ensure added accuracy before signing.
The company is also <a href="https://crypto.news/heres-how-the-fbi-used-fake-crypto-to-expose-widespread-fraud/" target="_blank" rel="noopener noreferrer nofollow">working with U.S. law enforcement agencies</a> to freeze the stolen funds and trace the attackers while collaborating with ZeroShadow to analyze the digital footprint left by the exploiters.
Read more: <a rel="noopener noreferrer nofollow" href="https://crypto.news/radiant-capital-reports-4-5m-flash-loan-attack/"> Radiant Capital reports $4.5m flash loan attack </a>

Post-mortem reveals stealthy malware injection led to $50m Radiant Capital exploit

Table of Contents

crypto.news

Other articles published on Oct 18, 2024

Join our free newsletter for daily crypto updates!