Radiant Capital Multi-Sig Hijack

On October 16, 2024, the cross-chain lending protocol Radiant Capital lost approximately $53 million to its second major attack of the year. The bug was not in Radiant's contracts — it was in what its signers saw on their screens while signing.

What happened

The story starts on September 11, 2024, when a Radiant developer received a Telegram message from someone impersonating a trusted former contractor. The message asked for feedback on a smart-contract audit and included a ZIP file with a decoy PDF — and a macOS malware payload, InletDrift, that established a persistent backdoor.

Over the following weeks the malware was deployed onto at least three signers' machines.

Radiant required 3 of 11 signatures to authorise privileged actions on its Safe multi-sig. When the attackers were ready, they triggered a routine-looking transaction on the Gnosis Safe interface. To the signers' eyes, the UI displayed the benign transaction they expected. The traffic actually reaching their hardware wallets, intercepted and rewritten by the malware, was a malicious upgrade transferring control of the lending markets.

Three signatures collected. The upgrade executed. $53M drained across Arbitrum and BNB Chain.

Aftermath

• Mandiant and others attributed the operation to UNC4736 / Citrine Sleet — also tracked as AppleJeus — a Lazarus sub-cluster known for the long-running InletDrift campaign.
• The Radiant attacker has held a substantial portion of the stolen ETH and reportedly grew the position to over $100M in paper value through subsequent ETH trading.
• Radiant relaunched markets after months of audits and contract redeployments. Recoveries to affected users came primarily through governance-controlled token reissuance.

Why it matters

Radiant was the textbook case for what later happened at scale at WazirX and Bybit: the trust boundary of a hardware wallet ends at the screen you read the transaction from. Independent transaction-simulation displays and out-of-band calldata verification have since become standard practice for any multi-sig managing meaningful TVL.