Decentralized finance (DeFi) project Radiant Capital has claimed that groups analyzing its breach earlier this week “believe this was one of the most sophisticated hacks ever recorded in DeFi” and that “many protocols are at risk”.

Radiant and Web3 auditor Hacken estimated the approximate scale of the theft at $50 million, and it’s thought that USDT, USDC, and ARB tokens were stolen.

This sum includes at least $16 million drained from a Radiant smart contract on BNB Chain, as well as funds stolen from some of Radiance’s trading pools on the Ethereum layer-2 network Arbitrum according to Hacken.

Radiant’s platform aims to provide liquidity across different blockchain protocols and allows users to deposit collateral and borrow assets.

Inside the hack

In a blog explaining the attack, Radiant claimed hackers successfully compromised at least three developers’ hardware wallets, though they were not able to say the exact number.

Radiant claims the hackers then used malware to “manipulate transaction data at the device level” and used “poisoned signatures” that looked legitimate to the signers authorizing the transaction.

The hackers allegedly used the compromised wallets to then carry out three multi-signature approvals to move crypto to wallets they controlled.

Radiant clarified that the impacted developers had all been “long-standing, trusted contributors” to its DAO.

Radiant claims the attack used a “sophisticated method” where Radiant developers, who were using popular Ethereum multisig wallet Safe{Wallet} for transaction verification, were presented with transactions that looked legitimate.

The project said hackers were able to get past multiple layers of verification, including full-stack Web3 interface Tenderly and other auditing tools.

Radiant Capital says it is working with U.S. law enforcement and Web3 cybersecurity firm ZeroShadow, to freeze the stolen assets and recover the funds.

The project said it is taking numerous steps to prevent future breaches, such as requiring that its contributors double-confirm transaction data for every transaction using analytics platform Etherscan.

In addition, contract upgrades and ownership transfers will now be subject to a minimum 72-hour delay, to give developers enough time to review and verify changes.

Though Radiance’s recent disaster may allegedly be one of the most sophisticated hacks in DeFi history, it's by no means the largest.

In May 2022, the Ronin Network, associated with the play-to-earn game Axie Infinity, suffered a $625 million loss at the hands of hackers.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。