ReadHistory

Radiant Capital hack

A cross-chain lending protocol drained of about $50M on October 16, 2024. Mandiant attributed it to a North Korea-linked actor (UNC4736 / AppleJeus) that used a fake-contractor Telegram lure to plant macOS malware on developers' machines and forge multisig approvals.

Also known as: Radiant Capital, Radiant, RDNT

Summary

Radiant Capital was a cross-chain lending protocol. On October 16, 2024, attackers seized control of its lending-pool contracts and drained about $50 million from its Arbitrum and BNB Chain markets. ^[1]^[2]

Method and attribution

According to a December 2024 update from Radiant and Mandiant, the operation began in September 2024 with a Telegram message impersonating a former contractor that delivered a zipped decoy PDF carrying the macOS backdoor "INLETDRIFT." The malware let attackers display legitimate-looking transactions to signers while signing malicious ones, defeating hardware wallets and simulation checks, and ultimately collecting enough multisig approvals to take over the contracts. Mandiant attributed the attack with high confidence to a DPRK-nexus group, UNC4736 (also tracked as AppleJeus / Citrine Sleet). Radiant had also suffered a separate ~$4.5M flash-loan hack in January 2024. ^[1]^[2]

Bracketed numbers refer to the numbered sources listed below.

Linked scams & cases

Qubit FinanceRelatedProjectsA BNB Chain lending protocol whose QBridge was exploited for about $80M on January 27, 2022. A logic flaw let an attacker mint unlimited 'qXETH' collateral without depositing any ETH, then borrow out the protocol's assets. Chainalysis later assessed it was likely North Korea-linked.

People & entities involved

Contagious Interview (UNC4736)Attributed actorOrganizations & groupsA North Korea-linked campaign that poses as recruiters/contractors to trick developers and crypto workers into running malware (e.g. BeaverTail, InvisibleFerret, INLETDRIFT). Tracked as UNC4736 / AppleJeus / Citrine Sleet; linked to the Radiant Capital theft.

Sources (2)

Radiant Capital Incident Update (Mandiant attribution) — Radiant Capital
Radiant Capital Says North Korean Hackers Behind $50 Million Hack — CoinDesk