A recent cyberattack has resulted in a significant loss of over $50 million for the blockchain lending protocol Radiant Capital, according to experts in the field of security and data from the blockchain. The attack occurred when an attacker took control of Radiant Capital's contracts on the blockchain by obtaining three of the private keys that govern the protocol's operations. Security experts have revealed that the Radiant Capital contracts were compromised on both the BSC and ARB chains using the 'transferFrom' function, enabling the attackers to drain users' funds in various cryptocurrencies, including $USDC, $WBNB, and $ETH.
The Radiant platform is controlled by a multi-signature wallet that requires 11 signers, and the attacker managed to obtain three of these private keys, which was sufficient to upgrade the platform's smart contracts. The Radiant platform offers a range of tools that allow users to borrow, lend, and bridge cryptocurrencies across different blockchains. This incident marks the second time this year that the protocol has been targeted in a security breach, following a previous hack in January that resulted in a loss of $4.5 million due to a bug in the smart contracts.
The exact method by which the private keys were compromised in the recent attack is still unclear. However, some members of an Ethereum security group have speculated that the attack might have originated from a compromised front-end, potentially allowing the legitimate key-holders to unintentionally interact with a malicious protocol. Radiant has acknowledged the security breach on its official social media account but has not provided detailed information. The company stated that it is working with various partners to address the issue and will provide updates as soon as possible.
The markets on Base and Mainnet have been paused until further notice. As a decentralized autonomous community, or DAO, Radiant aims to unify fragmented liquidity across Web3 money markets into a single safe and user-friendly omnichain. This story is still developing, and Radiant Capital has not yet responded to requests for comment.