Ethereum

Radiant

Radiant Capital

Dubai

Radiant Capital has disclosed a post-mortem for the Oct. 16 attack that <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/radiant-capital-pauses-contracts-exploit-fears" rel="noopener noreferrer nofollow" target="_blank" text="null" title="https://cointelegraph.com/news/radiant-capital-pauses-contracts-exploit-fears">resulted in the theft of over $50 million</a> in digital assets from the BNB Chain and Arbitrum networks. According to Radiant, the attacker compromised the devices of three of its long-standing developers.&nbsp;
Hackers were able to <a data-ct-non-breakable="null" href="https://medium.com/@RadiantCapital/radiant-post-mortem-fecd6cd38081https://medium.com/@RadiantCapital/radiant-post-mortem-fecd6cd38081" rel="noopener noreferrer nofollow" target="_blank" text="null" title="https://medium.com/@RadiantCapital/radiant-post-mortem-fecd6cd38081https://medium.com/@RadiantCapital/radiant-post-mortem-fecd6cd38081">compromise</a> the devices through a “sophisticated malware injection” used to sign malicious transactions.&nbsp;
“The devices were compromised in such a way that the front-end of Safe{Wallet} (f.k.a. Gnosis Safe) displayed legitimate transaction data while malicious transactions were signed and executed in the background,” the Radiant team explained in a blog post.&nbsp;
Radiant Capital is a decentralized finance (DeFi) platform that allows users to earn interest and borrow assets across multiple blockchain networks. It operates like an “omnichain money market,” enabling cross-chain transactions on lending markets in different networks, such as Ethereum, BNB and Arbitrum. Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/radiant-capital-pauses-contracts-exploit-fears" rel="noopener noreferrer nofollow" target="_blank" text="null" title="https://cointelegraph.com/news/radiant-capital-pauses-contracts-exploit-fears">Radiant Capital halts lending after exploit</a>
<h2 id="strong-the-attack-strong">The attack&nbsp;</h2>
According to the company, the breach occurred during a routine multisignature emissions adjustment, a process that takes place “periodically to adapt to market conditions and utilization rates.”
Multisignature is the dominant means of securing Web3 protocols. it requires multiple signatures to authorize a transaction.&nbsp;
Once the transactions were approved, the compromised devices intercepted these approvals and replaced them with a malicious transaction, which was then forwarded to the hardware wallets for signature. As soon as the Safe Wallet detected an issue, it displayed an error message, prompting the users to attempt the signature again.&nbsp;
This type of failure can arise from a number of factors, such as gas price fluctuations, nonce mismatch, network congestion, and insufficient gas limit, among others.
“As a result, this behavior did not raise immediate suspicion,” said the team. This process ultimately allowed the attackers to gather three valid signatures.
<figure><img alt="Radiant Capital hacker compromised developers’ devices — post-mortem&nbsp;" src="https://s3.cointelegraph.com/uploads/2024-10/0192a06c-2c91-7f22-ba97-01f6b0982f58" title="">
 <figcaption style="text-align: center;">
 Losses across various attack types in 2024. Source: Hacken
 </figcaption>
</figure>
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/ai-robots-hacked-to-cause-real-world-harm" rel="noopener noreferrer nofollow" target="_blank" text="null" title="https://cointelegraph.com/news/ai-robots-hacked-to-cause-real-world-harm">Researchers hack AI-enabled robots to cause ‘real world’ harm</a>
As per Radiant, the signed transactions still appeared legitimate within the user interface, making the attack difficult to detect. The breach was also undetectable during the manual review of the Gnosis Safe UI and Tenderly simulation stages of the routine transaction.
“This has been confirmed by external security teams, including SEAL911 and Hypernative,” noted the post-mortem.&nbsp;
Along with draining assets worth $50 million, the hackers exploited open approvals to withdraw funds from users’ accounts. Other Radiant core developers may also have had their devices compromised. The protocol has requested users to revoke approvals on all chains to mitigate further incidents:&nbsp;
<blockquote>
 “All users of the Radiant platform were strongly advised to revoke any approvals on ALL chains — Arbitrum, BSC, Ethereum &amp; Base.”
</blockquote>
According to a report by cybersecurity firm Hacken, access control exploits <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/hackers-got-away-with-440m-in-28-exploits-in-q3-report" rel="noopener noreferrer nofollow" target="_blank" text="null" title="https://cointelegraph.com/news/hackers-got-away-with-440m-in-28-exploits-in-q3-report">were responsible for $316 million</a> in lost funds during the third quarter. This accounts for nearly 70% of all crypto funds stolen during the quarter.
Magazine:&nbsp;<a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/rabby-scammer-konpyl-crypto-ceo-mountain-victims/" rel="noopener noreferrer nofollow" target="null" text="null" title="null">Fake Rabby Wallet scam linked to Dubai crypto CEO and many more victims</a>

Radiant Capital hacker compromised developers’ devices — post-mortem

Table of Contents

Cointelegraph

Other articles published on Oct 18, 2024

Covalent’s EWM Light Client: The Key To Securing Ethereum’s Future Through Preserving Historical ...

Dogecoin and Bonk Rally, But Experts Warn of Market Correction

Binance's 60th Launchpool Project: What is Scroll?

Kraken Launches $kBTC: Fully Backed Bitcoin Token for Ethereum and OP Mainnet

Solana and RCO Finance Share Bullish Alerts: Which Coin Has Growth Potential?

$KERORO Hits Solana With A Seismic Shift Expected (18 Oct)

Join our free newsletter for daily crypto updates!