Just Another Hack: Radiant Capital Victimized for $50M

[TomPluz]

Radiant Capital, a blockchain lending protocol, has lost more than $50 million in a hack, blockchain data and security experts say.

The attack struck Radiant's Ethereum Layer 2 Arbitrum instance before later spilling over to the BNB Chain. The hacker manipulated the protocol by utilizing a smart contract function called "TransferFrom," which grants permission for one account to transfer tokens from another account to a third.

The hacked asset was transferred to a wallet starting with "0x0629b" that reportedly contained more than $5 million in tokens. According to DeBank, the same wallet had a balance of $51 million and an astronomical 2,619,512.54% surge in token holdings not long after the attack.

Source: Coinmarketcap Community News.

Just as predicted, there will be more and more hacks and scams as we are nearing the end of the year and the expected big bull run in 2025. Seems to me that hackers are really so creative in what they are doing and they can be ahead of the game of cat and mouse. Now, one of the takeaways here is that the wallet where the stolen assets were transferred belong to someone (or maybe a group, perhaps) with already substantial resources...and it can mean these hackers really got the money financing their online operations. With a very wide market and having tasted the sweet smell of success, they are right now planning to strike more other platforms that got vulnerabilities to exploit.

[robelneo]

 With a very wide market and having tasted the sweet smell of success, they are right now planning to strike more other platforms that got vulnerabilities to exploit.

There will be more coming; hacking is a lucrative business; there are many platforms and individuals to hack, and they will never stop until they are caught, problem is sometimes they are not caught and even if they are caught they have a way to get out or do a compromise.
With how hackers do their business, its time for companies to upgrade and spend on their security, Companies that cannot upgrade their security will be left behind and lose trust of the community.

[Faisal2202]

Just as predicted, there will be more and more hacks and scams as we are nearing the end of the year and the expected big bull run in 2025. Seems to me that hackers are really so creative in what they are doing and they can be ahead of the game of cat and mouse. Now, one of the takeaways here is that the wallet where the stolen assets were transferred belong to someone (or maybe a group, perhaps) with already substantial resources...and it can mean these hackers really got the money financing their online operations. With a very wide market and having tasted the sweet smell of success, they are right now planning to strike more other platforms that got vulnerabilities to exploit.

At the end of the chain, somehow these hacks will connect with the lazarous group of NK because most of the hacks that happened in 2024 were done by this group from NK and this hack might also be their work. I did not see the addresses for how much funds they have, but I don't see any USDT and I recently learned that Tether can seize USDT even if kept in a non-custodial wallet, they can seize it so that's why hackers don't hack in USDT form.

They hack in other tokens to move them freely I hope one day they will get caught and just to be a little accurate the stolen price is around $58k CMIIW.

[joniboini]

I don't see any USDT and I recently learned that Tether can seize USDT even if kept in a non-custodial wallet, they can seize it so that's why hackers don't hack in USDT form.

Depending on how the hacking takes place, I can see them convert the USDT to other tokens and withdraw the deposits from there. I guess that's one plus point for Tether, although I don't think anyone is comfortable knowing Tether can freeze their tokens anytime regardless of what they do. Especially when the rate of abuse and control is high.

[ABCbits]

So it's another case of bug inside a smart contract. While i'm aware it's hard to write smart contract or program without any bug, i wonder whether Radiant Capital perform audit on their smart contract before it's deployed on blockchain network.

I don't see any USDT and I recently learned that Tether can seize USDT even if kept in a non-custodial wallet, they can seize it so that's why hackers don't hack in USDT form.

Depending on how the hacking takes place, I can see them convert the USDT to other tokens and withdraw the deposits from there. I guess that's one plus point for Tether, although I don't think anyone is comfortable knowing Tether can freeze their tokens anytime regardless of what they do. Especially when the rate of abuse and control is high.

AFAIK Tether usually freeze or confiscate USDT upon government request, so there's lower risk if the hacker could swap or exchange USDT quickly.

[MrSpasybo]

Just as predicted, there will be more and more hacks and scams as we are nearing the end of the year and the expected big bull run in 2025. Seems to me that hackers are really so creative in what they are doing and they can be ahead of the game of cat and mouse. Now, one of the takeaways here is that the wallet where the stolen assets were transferred belong to someone (or maybe a group, perhaps) with already substantial resources...and it can mean these hackers really got the money financing their online operations. With a very wide market and having tasted the sweet smell of success, they are right now planning to strike more other platforms that got vulnerabilities to exploit.

I'm not qualified to assess the security vulnerabilities in this lending project's source code, but it seems that hackers have successfully exploited it, resulting in a $50M loss for users. I thought HackTrend only occurred during the hottest market periods when new protocols are hastily launched to capitalize on market opportunities. I didn't expect Radiant Capital to have such a severe issue before we even entered the bullrun.

This serves as another warning about the ever-present risks in this market, regardless of timing or ecosystem. Project teams should implement more initiatives to incentivize white-hat hackers and pay more for professional auditing services in the crypto market. The cost of audits is justified when compared to the losses incurred in a hack.

I'm curious to know if users will be compensated or if Radiant Capital can recover from this loss.

[Faisal2202]

Depending on how the hacking takes place, I can see them convert the USDT to other tokens and withdraw the deposits from there. I guess that's one plus point for Tether, although I don't think anyone is comfortable knowing Tether can freeze their tokens anytime regardless of what they do. Especially when the rate of abuse and control is high.

How can it be a plus point for Tether? I mean, besides only an increment in their trading volume, I don't see another plus point. And if they would be seeking plus points, they won't acquire this feature in the first place I guess.

But this feature is also a plus point for them to make a good image among authorities and governments for their longevity. Yeah, no one really be comfortable to keep their funds in USDT form because for a single users if he keeps $1000 to $10,000 how can he reach out to the Tether team so they could seize the funds when his wallet gets hacked? There is not enough time for them in the first place so I think this feature of them is not so useful as hackers are now aware of this reality.

PS: There is another side to it that no one might be uncomfortable with them being in control of their USDTS while everything is becoming so centralized so why not their funds and for them they at least have the option to seize funds, which means there is some chance to recover lost funds as, Tether almost recovered $1.8 Billion funds if I am not wrong.

[joniboini]

But this feature is also a plus point for them to make a good image among authorities and governments for their longevity.

I mean exactly that, not in the sense that it will give them good trading value overall. I'm not a fan of centralized stablecoin either, especially for this reason. I'm fine with the tradeoff that if my money is lost then it's impossible to recover it (due to hacking, etc) as long as everything is under my control. It doesn't seem like that's the case with the market though. I guess it's understandable considering we like to have backup/other ways to recover our wealth.

i wonder whether Radiant Capital perform audit on their smart contract before it's deployed on blockchain network.

Is there any good auditor to begin with? The last few projects that I've followed got hacked even if their smart contracts are deemed 'secure' by third parties. Granted they're not open source so there's a high chance those auditors got paid for making that judgment.

[Jating]

 With a very wide market and having tasted the sweet smell of success, they are right now planning to strike more other platforms that got vulnerabilities to exploit.

There will be more coming; hacking is a lucrative business; there are many platforms and individuals to hack, and they will never stop until they are caught, problem is sometimes they are not caught and even if they are caught they have a way to get out or do a compromise.
With how hackers do their business, its time for companies to upgrade and spend on their security, Companies that cannot upgrade their security will be left behind and lose trust of the community.

Unfortunately, you are right, and it will be a cat and mouse game for developers and then this cyber criminals. So it's really very important for this developers to really look at the code and should do a lot of penetration testing to see that it's full proof. And I guess  this is just one drawback of open source code though, as others can see the code and they can manipulate it to their favor. Hopefully funds are SAFU although I doubt it. The next best thing to do is to just follow that address and then they should hire a blockchain forensics to trace where those $51 million will go.

[Baofeng]

But this feature is also a plus point for them to make a good image among authorities and governments for their longevity.

I mean exactly that, not in the sense that it will give them good trading value overall. I'm not a fan of centralized stablecoin either, especially for this reason. I'm fine with the tradeoff that if my money is lost then it's impossible to recover it (due to hacking, etc) as long as everything is under my control. It doesn't seem like that's the case with the market though. I guess it's understandable considering we like to have backup/other ways to recover our wealth.

i wonder whether Radiant Capital perform audit on their smart contract before it's deployed on blockchain network.

Is there any good auditor to begin with? The last few projects that I've followed got hacked even if their smart contracts are deemed 'secure' by third parties. Granted they're not open source so there's a high chance those auditors got paid for making that judgment.

There are some 3rd party auditors, but still even if they give it a go, those hackers will still some find loopholes and exploit it. So it's really hard to just lean on those 3rd party in my opinion.

So with that, Radiant might have perform audit, but it doesn't mean that they are safe from this hackers.

And I do agree that since we are in the bull run, this criminals are very active to find their target. Hopefully if they are going to trace, maybe one mistake of this hackers could lead investigators to them.

[ABCbits]

i wonder whether Radiant Capital perform audit on their smart contract before it's deployed on blockchain network.

Is there any good auditor to begin with? The last few projects that I've followed got hacked even if their smart contracts are deemed 'secure' by third parties. Granted they're not open source so there's a high chance those auditors got paid for making that judgment.

I'm sure good auditor exist out there. Although it's hard to know whether an auditor is good at their job or not. At best, we could exclude auditor or smart contract who doesn't want to share detail of audit result.

[Faisal2202]

I mean exactly that, not in the sense that it will give them good trading value overall. I'm not a fan of centralized stablecoin either, especially for this reason. I'm fine with the tradeoff that if my money is lost then it's impossible to recover it (due to hacking, etc) as long as everything is under my control. It doesn't seem like that's the case with the market though. I guess it's understandable considering we like to have backup/other ways to recover our wealth.

Other ways or alternative ways? If a person can get alternative options by choosing another path, then he will choose the other path. This means alternative options are better than having none. I got your point, and yeah, people will even prefer centralized exchanges over DEXs because they know they have some chance with CEXs to recover their funds if CEXs make a mistake or get hacked.

But if they would be keeping their funds secure means taking full custody, then there is no chance to recover the funds, so they prefer insurance.

[Bobcrypto]

Any crypto firm that has no security plans in terms of constant upgrade and monitoring will face tough time from hackers on the crypto space. The need for constant upgrade can not be overlooked because we all know that there are big capital (funds) entering into cryptocurrency economy almost everyday, and it is required that company pay much more attention to the security of their platforms to safeguard users funds all the time.
In addition, I think hacking will be on the rising because they are upgrading their tactics, and it look like they are discovering some loopholes on companies sites which is a setbacks to their security system.

[Faisal2202]

There are some 3rd party auditors, but still even if they give it a go, those hackers will still some find loopholes and exploit it. So it's really hard to just lean on those 3rd party in my opinion.

So with that, Radiant might have perform audit, but it doesn't mean that they are safe from this hackers.

And I do agree that since we are in the bull run, this criminals are very active to find their target. Hopefully if they are going to trace, maybe one mistake of this hackers could lead investigators to them.

Even if investigators find the hacker's like not knowing where he lives but could actually trace the wallet correctly, which is difficult in some cases, they won't find any contact, and even if they find they can't trace them because hackers are nowadays working in groups (or maybe they were already working in groups).

Well, the point is hackers are smarter than white hat hackers nowadays, and projects should hire more white hat hackers and experienced ones not just to show off they have one or one team but they must care about the project and hire some experienced ones.

[hugeblack]

lending protocol, bridges and decentralized platforms are what you should stay away from at the moment, they are centralized, not reviewed and have many back doors. It is better to trade on centralized platforms with small amounts and withdraw them directly to their wallet.