Radiant links $50 million crypto heist to North Korean hackers

Share:

Radiant Capital now says that North Korean threat actors are behind the $50 million cryptocurrency heist that occurred after hackers breached its systems in an October 16 cyberattack.

The attribution comes after investigating the incident, assisted by cybersecurity experts at Mandiant, who say the attack was conducted by North Korean state-affiliated hackers known as Citrine Sleet, aka “UNC4736 and “AppleJeus.”

The US previously warned that North Korean threat actors targeting cryptocurrency firms, exchanges, and gaming companies to generate and launder funds to support the country’s operations.

October incident

Radiant is a decentralized finance (DeFi) platform that allows users to deposit, borrow, and manage cryptocurrency across multiple blockchain networks.

The platform utilizes Ethereum blockchain security through the Arbitrum Layer 2 scaling system and operates under a community-driven system enabling users to participate in governance through RDNT lockers, submit proposals, and vote on active initiatives.

On October 16, 2024, Radiant announced it suffered a $50M breach caused by ‘sophisticated malware’ targeting three trusted developers whose devices were compromised to execute the unauthorized transactions.

The hackers appeared to have exploited the routine multi-signature process, collecting valid signatures under the guise of transaction errors and stealing funds from Arbitrum and Binance Smart Chain (BSC) markets.

The attack bypassed hardware wallet security and multiple verification layers, and transactions appeared normal during manual and simulation checks, indicative of high sophistication.

Finger pointed at North Korea

Following an internal investigation of the attack, aided by Mandiant, Radiant could now share more information about the malware used and the perpetrators behind it.

The attack started on September 11, 2024, when a Radiant developer received a Telegram message spoofing a former contractor, tricking them into downloading a malicious ZIP file.

The archive contained a PDF file to be used as a decoy and a macOS malware payload named ‘InletDrift,’ which established a backdoor on the infected device.

Decoy PDF file used in the attack
Decoy PDF file used in the attack
Source: Radiant

Radiant says the attack was so well-designed and flawlessly executed that it bypassed all security measures in place.

“This deception was carried out so seamlessly that even with Radiant’s standard best practices, such as simulating transactions in Tenderly, verifying payload data, and following industry-standard SOPs at every step, the attackers were able to compromise multiple developer devices,” explained Radiant.

“The front-end interfaces displayed benign transaction data while malicious transactions were signed in the background. Traditional checks and simulations showed no obvious discrepancies, making the threat virtually invisible during normal review stages.”

Mandiant assessed with high confidence that the attack was conducted by UNC4736, the same threat group that was exposed for exploiting a zero-day vulnerability on Google Chrome earlier this year.

Given the successful bypass of its security measures, Radiant underlines the need for more robust, device-level solutions to enhance transaction security.

As for the stolen funds, the platform says it is collaborating with U.S. law enforcement and zeroShadow to recover any amounts possible.

Source

Cyber Security
Cyberattack
Threats
Technology
hackers

Leave a Comment

Your email address will not be published. Required fields are marked *

loader-image
London, GB
1:01 pm, Feb 8, 2025
weather icon 5°C
L: 5° | H: 6°
drizzle rain
Humidity: 92 %
Pressure: 1018 mb
Wind: 9 mph ENE
Wind Gust: 0 mph
UV Index: 0
Precipitation: 0.19 mm
Clouds: 100%
Rain Chance: 0%
Visibility: 2 km
Sunrise: 7:27 am
Sunset: 5:02 pm
DailyHourly
Daily ForecastHourly Forecast
Today 9:00 pm
weather icon
5° | 6°°C 0 mm 0% 4 mph 92 % 1023 mb 0 mm/h
Tomorrow 9:00 pm
weather icon
3° | 5°°C 1 mm 100% 10 mph 97 % 1030 mb 0 mm/h
Mon Feb 10 9:00 pm
weather icon
3° | 4°°C 1 mm 100% 11 mph 96 % 1029 mb 1.38 mm/h
Tue Feb 11 9:00 pm
weather icon
3° | 4°°C 0.38 mm 38% 8 mph 97 % 1020 mb 0 mm/h
Wed Feb 12 9:00 pm
weather icon
4° | 6°°C 0 mm 0% 5 mph 92 % 1023 mb 0 mm/h
Today 3:00 pm
weather icon
6° | 6°°C 0 mm 0% 4 mph 92 % 1018 mb 0 mm/h
Today 6:00 pm
weather icon
5° | 5°°C 0 mm 0% 4 mph 86 % 1019 mb 0 mm/h
Today 9:00 pm
weather icon
4° | 4°°C 0 mm 0% 3 mph 81 % 1023 mb 0 mm/h
Tomorrow 12:00 am
weather icon
3° | 3°°C 0 mm 0% 3 mph 84 % 1024 mb 0 mm/h
Tomorrow 3:00 am
weather icon
3° | 3°°C 0 mm 0% 4 mph 87 % 1025 mb 0 mm/h
Tomorrow 6:00 am
weather icon
4° | 4°°C 0.29 mm 29% 7 mph 94 % 1026 mb 0 mm/h
Tomorrow 9:00 am
weather icon
4° | 4°°C 0.99 mm 99% 7 mph 97 % 1028 mb 0 mm/h
Tomorrow 12:00 pm
weather icon
4° | 4°°C 1 mm 100% 10 mph 96 % 1028 mb 0 mm/h
Name Price24H (%)
Bitcoin(BTC)
€92,997.38
-1.94%
Ethereum(ETH)
€2,520.91
-5.71%
Tether(USDT)
€0.97
-0.03%
XRP(XRP)
€2.32
-0.66%
Solana(SOL)
€187.49
-2.77%
USDC(USDC)
€0.97
0.00%
Dogecoin(DOGE)
€0.239635
-2.89%
Shiba Inu(SHIB)
€0.000015
1.33%
Pepe(PEPE)
€0.000009
-3.20%
Scroll to Top