Web3 Security Firms Confirm North Korea’s Role in Radiant Capital Hack

Radiant Capital has revealed new findings about the $50 million hack targeting its decentralized finance (DeFi) platform in October, attributing the attack to a North Korea-aligned hacking group.

The attackers gained access through an elaborate scheme involving malware distributed via Telegram.

$50M Radiant Capital DeFi Hack

The breach, first discovered on October 16, 2024, prompted Radiant to partner with cybersecurity firms like Mandiant, zeroShadow, Hypernative, and SEAL 911 to investigate and mitigate the damage.

According to the official blog post, the attack was traced back to September 11, 2024, when a Radiant developer received a Telegram message from someone impersonating a former contractor. The message, crafted to appear harmless, requested feedback on a supposed career-related PDF file linked to smart contract auditing.

The sender convincingly spoofed a legitimate website, reducing suspicion. Once the file, titled Penpie_Hacking_Analysis_Report.zip, was opened, a macOS backdoor malware named INLETDRIFT was delivered. The malware communicated with an external server and appeared harmless by displaying a realistic PDF.

Despite Radiant’s adherence to rigorous security protocols, including transaction simulations and payload verifications, the malware evaded detection by manipulating front-end transaction data. Developers unknowingly signed off on malicious transactions, believing they were legitimate. The attackers’ planning rendered the intrusion nearly undetectable during routine checks.

zeroShadow, a Web3 security solutions provider, has also corroborated Radiant Capital’s assessment that the hack was the work of North Korea-linked actors. In a statement on December 9, the platform said,

“We also attribute the Radiant Capital October 16 incident to DPRK with high confidence based on multiple indicators that we have gathered on and off chain. We have tracked the movements to Hyperliquid as stemming from Radiant users failing to revoke permissions, and not the initial incident’s stolen funds.”

Radiant’s TVL Down by Over 97% This Year

Radiant Capital is a decentralized lending and borrowing protocol that integrates cross-chain capabilities through the use of LayerZero technology. DefiLlama’s latest figures place its total value locked (TVL) at a little over $6 million.

The October 16 hack is not the first time Radiant has been compromised this year. Back in January, a smart contract vulnerability was exploited, costing the platform $4.5 million, during which its TVL was significantly higher, surpassing $300 million, highlighting a significant decline in locked assets over the course of the year despite the bull run.