Briefing
The Radiant Capital DeFi lending protocol suffered a significant security breach in October 2024, resulting in an estimated loss of $50 million to $58 million across its Arbitrum and BNB Chain deployments. The incident stemmed from a sophisticated supply chain attack that compromised the protocol’s 3-of-11 multi-signature governance scheme. Attackers leveraged malware to trick signers into approving malicious transactions, ultimately gaining control over critical Pool Provider contracts and enabling unauthorized fund drainage. This event highlights the critical vulnerabilities inherent in complex multi-signature setups and the persistent threat of advanced persistent threat (APT) groups targeting high-value DeFi protocols.
Context
Prior to this incident, the DeFi ecosystem had already faced numerous exploits, including flash loan attacks and oracle manipulations, underscoring the inherent risks in smart contract interactions and governance mechanisms. Radiant Capital itself experienced an earlier flash loan attack in January 2024 due to rounding issues. The prevailing attack surface for many protocols included vulnerabilities in off-chain operational security, such as developer machine compromise or phishing, which could lead to the subversion of on-chain controls like multi-signature schemes. The reliance on human signers within multi-sig frameworks introduced a critical human element vulnerability.
Analysis
The attack’s technical mechanics involved a multi-stage supply chain compromise. A Radiant developer received a malicious ZIP file, disguised as a legitimate smart contract auditing report, from a spoofed former contractor. This file delivered sophisticated INLETDRIFT malware, establishing a persistent macOS backdoor. The attackers then used this access to manipulate the Gnosis Safe wallet frontend, displaying legitimate transaction data to signers while simultaneously pushing malicious transactions to their hardware wallets for blind signing.
With compromised signatures, the attacker gained control of the Pool Provider contract, which manages lending pools, and subsequently upgraded the pool contracts to malicious versions. These upgraded contracts retained the original permissions, allowing the attacker to drain user funds from wallets that had previously granted approvals.
Parameters
- Protocol Targeted → Radiant Capital
- Attack Vector → Multi-signature Compromise via Supply Chain Attack and Malware
- Financial Impact → $50 Million – $58 Million
- Affected Blockchains → Arbitrum, BNB Chain
- Malware Used → INLETDRIFT
- Attacker Affiliation → Suspected DPRK-aligned threat actor (UNC4736)
- Recent Fund Movement → $14 Million DAI swapped for ETH, $6.5 Million ETH sent to Tornado Cash
Outlook
Immediate mitigation for users involves revoking approvals for affected Radiant Capital contracts on Arbitrum and BNB Chain. This incident underscores the urgent need for enhanced supply chain security, robust hardware wallet usage with careful transaction verification (avoiding blind signing), and advanced threat detection for developer environments. Protocols should implement more stringent multi-sig operational procedures, including independent verification of transaction payloads. The event will likely drive new security best practices focusing on comprehensive endpoint security for core team members and a re-evaluation of the human element in decentralized governance.
Verdict
This sophisticated multi-signature compromise of Radiant Capital serves as a stark reminder that even robust on-chain governance can be subverted by advanced off-chain attack vectors, necessitating a holistic security posture encompassing both code and human elements.
