Radiant

DeFi

Radiant Capital

when

<p class="is-style-lead">Victims of DeFi lender Radiant Capital’s exploit were thrown into further disarray when a security firm erroneously shared a link to a wallet drainer while attempting to help them.</p> 
<p>On Oct. 17,&nbsp; web3 security startup Ancilia was criticized for its negligence after it redirected victims of the attack to an X account masquerading as the DeFi lender to dupe users into visiting a malicious site designed to drain users’ assets via <a href="https://crypto.news/approval-phishing-scams-a-much-bigger-problem-than-first-thought/" target="_blank">approval phishing</a>.</p> 
<h2 class="wp-block-heading" id="security-experts-tricked">Security experts tricked</h2> 
<p>Ancilia was the first to report the <a href="https://crypto.news/radiant-capital-exploited-for-50m-on-arbitrum-bsc/" target="_blank">exploit</a> on Oct. 16, which saw Radiant Capital’s smart contracts on BNB Chain and Arbitrum compromised via the <a href="https://crypto.news/rarible-nft-marketplace-vulnerability-check-point/" target="_blank">‘transferFrom’ function</a>, allowing attackers to drain over $50 million in assets, including USDC, WBNB, and ETH.</p> 
<p>Following the breach, Radiant <a href="https://x.com/RDNTCapital/status/1846673545973432333" target="_blank" rel="nofollow">urged</a> users to revoke all approvals using Revoke.cash, a tool that allows users to disconnect their wallets from potentially malicious smart contracts, to prevent further losses.&nbsp;</p> 
<p>This step was necessary because the attackers had gained control of several private keys, allowing them to control the DeFi protocol’s multi-signature wallet by transferring ownership.</p> 
<p> You might also like: <a rel="" href="https://crypto.news/trader-loses-1-28m-in-pepe-and-other-altcoins-to-inferno-drainer-linked-wallet/"> Trader loses $1.28m in PEPE and other altcoins to Inferno Drainer-linked wallet </a> </p> 
<p>Crypto scammers jumped on the opportunity, impersonating Radiant Capital on X and pushing fake links disguised to mimic the Revoke.cash platform. Ancilia, not realizing the scam, accidentally shared the fake post, while asking users to “follow the link,” which led straight to the wallet drainer.</p> 
<figure class="wp-block-image is-resized">
 <img decoding="async" src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXfqLR3jnw8qJJicD4AqUhm9oOMYoJ4vmsBeAbHRaRArrdjhcOqzOCanGKJ8m6C5Z3ZyBsdOmN98_jobUenXMaHeaBcBnId6RpdLXhjatAXeHvAhMDxuBogy9oOZY-2DP4LHITuyiXc1D0Ee5CCUA9nzo74E?key=Q85s7AgPeNVwK353AJfCYA" alt="Web3 security firm’s mistake exposes victims of $50m exploit to wallet drainer - 21" style="width: 100%;height:auto">
 <figcaption class="wp-element-caption">
  Deleted post from Ancilia reposting a Radiant Capital impersonator | Source: Spreek/X
 </figcaption>
</figure> 
<p>If unlucky victims clicked through and connected their wallets, approving the permissions, their funds would’ve been siphoned off.</p> 
<p>Eagle-eyed community members were quick to point out the security firm’s blunder and <a href="https://x.com/spreekaway/status/1846637474467975648" target="_blank" rel="nofollow">criticized</a> Ancilia’s negligence as a “‘trusted’ security account.” Subsequently, Ancilia deleted the post, issued an apology, and pointed users to the original Radiant Capital account.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">We accidentally re-posted a scam link, apologized for that. The post has been deleted. The official Twitter handle is <a href="https://twitter.com/RDNTCapital?ref_src=twsrc%5Etfw" target="_blank" rel="nofollow">@RDNTCapital</a></p>— Ancilia, Inc. (@AnciliaInc) <a href="https://twitter.com/AnciliaInc/status/1846638082562609397?ref_src=twsrc%5Etfw" target="_blank" rel="nofollow">October 16, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<p>The severity of these scams is highlighted by the fact that the bad actors orchestrate these approval phishing campaigns from hijacked X accounts that often bear the golden verification checkmark, which is designated to verified organizations on the social media platform.</p> 
<p>Then, by slightly modifying the account’s name and handle, scammers are able to trick web3 users. In this instance, they changed the account name to “Radiarnt Capital” instead of “Radiant Capital” and altered the handle to “@RDNTCapitail” instead of “@RDNTCapital.” While these changes may seem easy to spot, many users often miss them at first glance.</p> 
<p>At the time of writing, several instances of the aforementioned phishing post were still live under Ancilia’s posts.</p> 
<h2 class="wp-block-heading" id="impersonation-scams">Impersonation scams</h2> 
<p>Impersonating genuine projects to trick crypto investors has become one of the most common tools for scammers to lure victims onto phishing platforms.&nbsp;</p> 
<p>Earlier this year, cybersecurity firm SlowMist <a href="https://crypto.news/slowmist-reports-80-of-x-comments-related-to-phishing-software/" target="_blank">warned</a> that over 80% of the comments under posts from major crypto projects were scams. Meanwhile, a ScamSniffer <a href="https://crypto.news/over-46m-lost-to-crypto-phishing-in-february-social-media-impersonations-at-fault/" target="_blank">report</a> pointed out that this tactic was the go-to move for scammers, causing millions of dollars in losses for crypto investors in February.</p> 
<p>Just a day before the recent attack, bad actors were seen <a href="https://crypto.news/crypto-phishing-scammers-target-investors-chasing-trump-backed-wlfi-tokens/" target="_blank">running a similar campaign</a> to dupe WLFI investors. Scammers have even <a href="https://crypto.news/scammers-target-google-ads-to-mimic-crypto-recovering-service/" target="_blank">targeted</a> Revoke Cash users by impersonating the service in early September and promoting a malicious site using Google Ads.</p> 
<p>In related news, this was the second time Radiant Capital was exploited this year. Hackers were able to <a href="https://crypto.news/radiant-capital-reports-4-5m-flash-loan-attack/" target="_blank">get away with $4.5 million</a> from the protocol in a January flash loan attack.&nbsp;</p> 
<p> Read more: <a rel="" href="https://crypto.news/blockaid-fends-off-700k-in-losses-from-new-angel-drainer/"> Blockaid fends off $700k in losses from new Angel drainer </a> </p>

Web3 security firm’s mistake exposes victims of $50m exploit to wallet drainer

Table of Contents

crypto.news

Other articles published on Oct 17, 2024

BlackRock Calls Bitcoin "A Unique Diversifier" in Its New Report

Market Analysts Assess WIF and ENA Coins

Are Stablecoins and Crypto Challenging Fiat Currency Dominance in East Asia?

Decentralized AI Summit at MIT votes OriginTrail, powered by Polkadot, as the best decentralized ...

Could Conflict in the Middle East Raise Bitcoin Prices?

ApeCoin DAO Closes Four Working Groups Amid Budget Concerns

Join our free newsletter for daily crypto updates!