Radiant

DeFi

Radiant Capital

when

Radiant Capital said a $50 million hack on its decentralized finance (DeFi) platform in October was carried out through malware sent via Telegram from a North Korea-aligned hacker posing as an ex-contractor.
Radiant said in a Dec. 6 <a data-ct-non-breakable="null" href="https://medium.com/@RadiantCapital/radiant-capital-incident-update-e56d8c23829e" rel="null" target="null" text="null" title="null">update</a> of an ongoing investigation that its contracted cybersecurity firm Mandiant has assessed “with high-confidence that this attack is attributable to a Democratic People’s Republic of Korea (DPRK)-nexus threat actor.”
The platform said a Radiant developer received a Telegram message with a zip file from a “trusted former contractor” on Sept. 11 asking for feedback on a new endeavor they were planning.
“Upon review, this message is suspected to have originated from a DPRK-aligned threat actor impersonating the former contractor,” it said. “This ZIP file, when shared for feedback among other developers, ultimately delivered malware that facilitated the subsequent intrusion.”
On Oct. 16, the <a data-ct-non-breakable="null" href="https://cointelegraph.com/learn/articles/defi-a-comprehensive-guide-to-decentralized-finance" rel="null" target="null" text="null" title="null">DeFi platform</a> was <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/radiant-capital-pauses-contracts-exploit-fears" rel="null" target="null" text="null" title="null">forced to halt its lending markets</a> after a hacker gained control of several signers’ private keys and smart contracts. North Korean hacking groups have long targeted crypto platforms and have <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/north-korean-hackers-stolen-crypto" rel="" target="_self" text="null" title="https://cointelegraph.com/news/north-korean-hackers-stolen-crypto">stolen $3 billion</a> in crypto between 2017 and 2023.
<figure>
 <img alt="Hackers, North Korea" src="https://s3.cointelegraph.com/uploads/2024-12/0193a922-1e19-7e08-80de-0f55888b8061" title="">
 <figcaption style="text-align: center;">
 Source: <a data-ct-non-breakable="null" href="https://x.com/RDNTCapital/status/1865201964625035526" rel="null" target="null" text="null" title="null">Radiant Capital</a>
 </figcaption>
</figure>
Radiant said the file didn’t arouse suspicions because “requests to review PDFs are routine in professional settings,” and developers “frequently share documents in this format.”&nbsp;&nbsp;
The domain associated with the ZIP file also spoofed the contractor’s legitimate website.
Multiple Radiant developer devices were compromised during the attack, and front-end interfaces displayed benign transaction data while malicious transactions were signed in the background.
“Traditional checks and simulations showed no obvious discrepancies, making the threat virtually invisible during normal review stages,” it added.
“This deception was carried out so seamlessly that even with Radiant’s standard best practices, such as simulating transactions in Tenderly, verifying payload data, and following industry-standard SOPs at every step, the attackers were able to compromise multiple developer devices,” Radiant wrote.&nbsp;
<figure>
 <img alt="Hackers, North Korea" src="https://s3.cointelegraph.com/uploads/2024-12/0193a924-46bf-785d-b6a3-ffbd6f5ae4f9" title="">
 <figcaption style="text-align: center;">
 &nbsp;An example of a decoy PDF that could be used by a malicious hacker group. Source: <a data-ct-non-breakable="null" href="https://medium.com/@RadiantCapital/radiant-capital-incident-update-e56d8c23829e" rel="null" target="null" text="null" title="null">Radiant Capital</a>
 </figcaption>
</figure>
Radiant Capital said the threat actor responsible is known as “UNC4736,” also known as “Citrine Sleet,” an entity aligned with North Korea’s main intelligence agency, the Reconnaissance General Bureau (RGB). It may be a sub-cluster of the hacking collective the <a data-ct-non-breakable="null" href="https://cointelegraph.com/people/top-people-in-crypto-and-blockchain-2023/lazarus-group/" rel="null" target="null" text="null" title="null">Lazarus Group</a>.
The hackers<a data-ct-non-breakable="null" href="https://cointelegraph.com/news/radiant-capital-exploiter-moves-52-million-stolen-funds" rel="null" target="null" text="null" title="null"> moved about $52 million</a> of the stolen funds from the attack on Oct. 24.
“This incident demonstrates that even rigorous SOPs, hardware wallets, simulation tools like Tenderly, and careful human review can be circumvented by highly advanced threat actors,” Radiant Capital wrote in its update.
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/radiant-capital-resumes-lending-post-hack" rel="null" target="null" text="null" title="null">Radiant Capital $58M hack an expensive ‘lesson’ for DeFi</a>
“The reliance on blind signing and front-end verifications that can be spoofed demands the development of stronger, hardware-level solutions for decoding and validating transaction payloads,” it added.&nbsp;
It was not the first time Radiant has been compromised this year. The platform <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/radiant-capital-lending-protocol-flash-loan-attack-arbitrum" rel="null" target="null" text="null" title="null">halted lending markets in January</a> following a $4.5 million flash loan exploit.&nbsp;
After the two exploits this year, Radiant’s total value locked has dropped significantly, from over $300 million at the end of last year to around $5.81 million as of Dec. 9, <a data-ct-non-breakable="null" href="https://defillama.com/protocol/radiant#information" rel="null" target="null" text="null" title="null">according</a> to DefiLlama.
Magazine: <a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/bitcoin-price-100k-donald-trump-paul-atkins-sec-gary-gensler-hodlers-digest/" rel="null" target="null" text="null" title="null">BTC hits $100K, Trump taps Paul Atkins for SEC chair, and more: Hodler’s&nbsp; Digest, Dec. 1 – 7</a>

Radiant Capital says North Korea posed as ex-contractor to carry out $50M hack

Cointelegraph

Other articles published on Dec 9, 2024

Gasless Transactions: The Key to Accessible Blockchain for Everyone

Floki Inu Introduces New Debit Card Service

El Salvador plans Bitcoin policy changes to secure $1.3B IMF loan — FT

Xcoub: Revolutionizing Staking Solutions

Market Trends Show Altcoins Drop Significantly

Crypto Tax Rate Basics: Cryptocurrency Tax Explained

Join our free newsletter for daily crypto updates!