Radiant Capital Asks Users To Revoke Access To Compromised Contracts Following $50M Exploit

Key Takeaways

• Exploited Radiant Capital contracts drained over $50 million worth of crypto on Wednesday.
• The attacker would have needed access to at least three multi-sig keys to deploy the malicious contracts.
• Radiant has asked users to revoke permissions for affected Arbitrum and BSC contracts.

In the latest major crypto hack of 2024, the decentralized finance (DeFi) protocol Radiant Capital was hacked on Wednesday, Oct. 16, resulting in over $50 million loss. 

To prevent further losses, it has suspended its lending markets and asked users to revoke access to compromised contracts.

Radiant Hacked for Over $50 Million

News of Radiant’s security compromise emerged late Wednesday when DeFi Security reported that the cross-chain platform Arbitrum and BSC contracts had been maliciously upgraded to drain users’ funds.

The hacker would have needed access to at least three of Radiant’s 11 multi-sig keys to pull off the heist.

The platform hasn’t publicly disclosed the identities of the individuals or entities who hold these multi-sig keys, as this information is typically kept confidential to maintain security.

The attack started with a multi-call BSC transaction involving over $303,000 in USDC, $451,000 in BUSDT, 160 BTCB, 220.6 wBETH, 8469 wBNB, and 470.4 ET drained from Radiant pools.

Although Radiant deploys contracts across Ethereum, Base, Arbitrum, and BSC, only the last two appear to have been affected by the latest exploit.

Second Exploit This Year

Wednesday’s hack is the second to hit Radiant Capital this year.

In January, a hacker took advantage of a vulnerability in Radiant’s smart contracts to steal crypto worth $4.5 million. 

In the previous case, the attacker manipulated loan collateral and liquidated assets before Radiant implemented security patches to address the vulnerability.

Advice to Users

Following the latest attack, Radiant Capital urged its users to revoke permissions on the compromised contracts immediately. 

The team posted on social media, advising users to sever ties with the vulnerable smart contracts.