On October 16, 2024, Radiant Capital, a decentralized cross-chain lending protocol built on LayerZero, suffered a breach that resulted in the theft of approximately $50 million. The attack's sophistication and precision shocked the DeFi community, with security experts like @bantg calling it “really scary.” A subsequent incident report by Radiant Capital, alongside an X thread from OneKeyHQ, linked the hack to North Korean threat actors.
The Attack Vector: A Disguised PDF
The attack began on September 11, when a Radiant developer received a Telegram message from someone impersonating a trusted former contractor. The imposter claimed to be seeking a new job in smart contract auditing and requested feedback on past work, providing a link to a compressed PDF. The link redirected to a website mimicking the real contractor’s site to add credibility.
The zip file contained a disguised executable named INLETDRIFT. Upon opening, the malware installed a backdoor on the developer’s macOS device, granting attackers persistent access. Tragically, the compromised file was shared with other team members for feedback, further spreading the malware within the organization.
Man-in-the-Middle Attack and Blind Signing Exploit
Using their access, the attackers executed a man-in-the-middle attack. While Radiant’s team relied on Gnosis Safe multisig wallets, the malware intercepted and manipulated transaction data. On developers' screens, transactions appeared legitimate, but the hackers replaced them with malicious instructions targeting the ownership of lending pool contracts.
By exploiting a blind signing vulnerability in Ledger hardware wallets, the attackers convinced developers to authorize a transferOwnership() call. In less than three minutes, the hackers drained all funds, removed backdoors, and erased traces of their activities, leaving minimal evidence for investigators.
Lessons for the DeFi Industry
This attack highlights the increasing sophistication of cyber threats. Key takeaways include: teams should shift to online collaboration tools to reduce malware risks; unverified files, especially from external sources, must be avoided; front-end transaction verification is vulnerable to spoofing and should be supplemented with advanced verification tools and supply chain monitoring; hardware wallets often lack detailed transaction summaries, increasing risk – enhanced support for multi-sig transactions could mitigate this; and strengthening asset governance with timelocks and governance frameworks can delay critical fund transfers, allowing teams to identify anomalies before losses occur.
The Radiant DAO continues to support Mandiant in its investigation, cooperating with Zeroshadow and U.S. law authorities to freeze stolen assets. Radiant has also expressed its desire to share lessons learned to help the entire industry raise security standards.