Penpie

Radiant

Radiant Capital

Read

Gnosis

A new postmortem report from Radiant Capital claims a North Korean state-backed hacker was behind the $50 million exploit of the protocol.
The attacker impersonated a “trusted former contractor” of Radiant Capital to deploy <a href="https://crypto.news/beware-of-clipper-malware-binance-warns-of-crypto-fraud/" target="_blank" rel="noopener noreferrer nofollow">malware</a> via a “zipped PDF” file shared across the messaging platform Telegram, the <a href="https://medium.com/@RadiantCapital/radiant-capital-incident-update-e56d8c23829e" target="_blank" rel="noopener noreferrer nofollow">report</a> noted, citing findings by cybersecurity firm Mandiant.
According to Radiant Capital, the file originated from a “DPRK-aligned threat actor” believed to be UNC4736, also referred to as Citrine Sleet, and the masterminds behind the <a href="https://crypto.news/microsoft-exposes-north-korea-related-hacker-targeting-crypto-startups/" target="_blank" rel="noopener noreferrer nofollow">AppleJeus malware</a>.&nbsp;
Leveraging the contractor’s prior relationship with Radiant’s team, the attacker crafted a convincing ruse by spoofing the contractor’s legitimate domain and sending a Telegram message requesting feedback on a supposed new project related to smart contract auditing.
“Requests to review PDFs are routine in professional settings — lawyers, smart contract auditors, and partners frequently share documents in this format,“ the report noted, adding that the message did not raise any suspicions and, as a result, was shared with other developers for feedback.
The zip file, which appeared to be an after-incident report of the Penpie exploit, actually contained the INLETDRIFT malware, which created a macOS backdoor that allowed the threat actor to compromise the hardware wallets of at least three Radiant developers.
You might also like: <a rel="noopener noreferrer nofollow" href="https://crypto.news/radiant-capital-hacker-moves-52m-worth-of-crypto-funds-into-ethereum/"> Radiant Capital hacker moves $52M worth of crypto funds into Ethereum </a>
During the Oct. 16 attack, the malware <a href="https://crypto.news/post-mortem-reveals-stealthy-malware-injection-led-to-50m-radiant-capital-exploit/" target="_blank" rel="noopener noreferrer nofollow">manipulated</a> the front-end interface of Safe{Wallet} (formerly known as Gnosis Safe), displaying legitimate transaction data to the developers while the malicious transactions were executed in the background.
Radiant noted that despite strict adherence to best practices like Tenderly simulations, payload verification, and industry-standard SOPs, the attackers managed to compromise multiple developer devices.
“Mandiant assesses with high-confidence that this attack is attributable to a Democratic People’s Republic of Korea (DPRK)-nexus threat actor,” the report added.
<h2 class="wp-block-heading" id="north-korean-hackers-stole-billions-in-crypto">North Korean hackers stole billions in crypto</h2>
UNC4736 is believed to have ties with the Democratic People’s Republic of Korea’s Reconnaissance General Bureau and has been known to target cryptocurrency-focused firms.
As previously reported by crypto.news, earlier this year, the group targeted crypto financial institutions by exploiting a zero-day <a href="https://crypto.news/north-korean-hackers-target-crypto-institutions-via-chromium-browser/" target="_blank" rel="noopener noreferrer nofollow">vulnerability</a> in the Chromium browser to bypass browser security and execute malicious code within the browser’s sandbox.
In September, the Federal Bureau of Investigation <a href="https://crypto.news/north-korea-aggressively-targeting-crypto-firms-warns-fbi/" target="_blank" rel="noopener noreferrer nofollow">warned</a> of the increasingly complex tactics used by North Korean hackers, noting they had taken an interest in targeting individuals linked to crypto exchange-traded funds.
A more recent <a href="https://crypto.news/north-korea-posing-as-it-workers-steal-billion-dollars/" target="_blank" rel="noopener noreferrer nofollow">report</a> from researchers at the Cyberwarcon Cybersecurity conference found that North Korean hackers managed to siphon over $10 million in just six months by infiltrating prominent companies as IT workers and other employees.
The roughly <a href="https://crypto.news/north-korean-crypto-hackers-raided-600m-in-2023/" target="_blank" rel="noopener noreferrer nofollow">$3 billion</a> stolen from the crypto sector by these state-backed hacking groups between 2017 and 2023 is allegedly used to <a href="https://crypto.news/north-korea-used-3-billion-of-stolen-crypto-to-develop-weapons-of-mass-destruction-report-says/" target="_blank" rel="noopener noreferrer nofollow">finance</a> North Korea’s nuclear weapons program.
Read more: <a rel="noopener noreferrer nofollow" href="https://crypto.news/post-mortem-reveals-stealthy-malware-injection-led-to-50m-radiant-capital-exploit/"> Post-mortem reveals stealthy malware injection led to $50m Radiant Capital exploit </a>

DPRK-linked hackers social engineered $50m Radiant Capital exploit: report

Table of Contents

crypto.news

Other articles published on Dec 9, 2024

XRP has 'most powerful chart in crypto' after breaking a 7-year price trend

Solana and Ethereum could soar but this meme coin has the market buzzing with 2024 hype

Bitcoin, Binance, Ethereum, Solana And Ripple: The Biggest Crypto News From The Past Week

Chainlink Eyes Breakout With 142% Address Count

Ethereum Leads Record Inflows as Digital Asset Products Reach All-Time High

XRP Price Crash: Will the Altcoin Drop to $1.57 in the Coming Weeks?

Join our free newsletter for daily crypto updates!