-
Sophisticated phishing and malware attacks by DPRK hackers exploited DeFi vulnerabilities.
-
Despite best practices, attackers manipulated smart contracts and hardware wallets to steal funds.
-
Phishing risks, blind signing flaws, and governance gaps highlight urgent need for stronger safeguards.
On October 16, 2024, Radiant Capital experienced a $50 million loss due to a cyberattack linked to North Korean hackers, raising urgent security concerns in DeFi.
Report Links North Korean Actors to Radiant Capital Incident
A report from OneKey, a Coinbase-backed crypto hardware wallet manufacturer, attributed the attack to North Korean hackers. The report extends from a recent medium post shared by Radiant Capital, which provided an incident update on the October 16 attack.
Reportedly, Mandiant, a leading cybersecurity firm, further linked the breach to UNC4736, a DPRK-aligned group also known as AppleJeus or Citrine Sleet. This group operates under the Reconnaissance General Bureau (RGB), North Korea’s primary intelligence agency.
Mandiant’s investigation revealed that the attackers meticulously planned their operation. They staged malicious smart contracts across multiple blockchain networks, including Arbitrum, Binance Smart Chain, Base, and Ethereum. These efforts reflect the advanced capabilities of DPRK-backed threat actors in targeting the DeFi sector.
The breach began with a calculated phishing attack on September 11, 2024. A Radiant Capital developer received a Telegram message from an individual impersonating a trusted contractor. The message included a zip file purportedly containing a smart contract audit report. This file, “Penpie_Hacking_Analysis_Report.zip,” was laced with malware known as INLETDRIFT, a macOS backdoor that facilitated unauthorized access to Radiant’s systems.
When the developer opened the file, it appeared to contain a legitimate PDF. However, the malware silently installed itself, establishing a backdoor connection to a malicious domain at atokyonews[.]com. This allowed the attackers to spread the malware further among Radiant’s team members, gaining deeper access to sensitive systems.
The hackers’ strategy culminated in a man-in-the-middle (MITM) attack. By exploiting compromised devices, they intercepted and manipulated transaction requests within Radiant’s Gnosis Safe Multisig wallets. While transactions appeared legitimate to developers, the malware covertly altered them to execute a transfer Ownership call, seizing control of Radiant’s lending pool contracts.
Execution of the Heist, Industry Implications, and Lessons Learned
Despite Radiant’s adherence to best practices, such as using hardware wallets, transaction simulations, and verification tools, the attackers’ methods bypassed all defenses. Within minutes of securing ownership, the hackers drained funds from Radiant’s lending pools, leaving the platform and its users reeling.
The Radiant Capital hack serves as a stark warning to the DeFi industry. Even projects adhering to rigorous security standards can fall prey to sophisticated threat actors. The incident highlighted critical vulnerabilities, including:
- Phishing Risks: The attack began with a convincing impersonation scheme, emphasizing the need for heightened vigilance against unsolicited file sharing.
- Blind Signing: While essential, hardware wallets often display only basic transaction details, making it difficult for users to detect malicious modifications. Improved hardware-level solutions are necessary to decode and validate transaction payloads.
- Front-End Security: The reliance on front-end interfaces for transaction verification proved inadequate. Spoofed interfaces enabled hackers to manipulate transaction data undetected.
- Governance Weaknesses: The absence of mechanisms to revoke ownership transfers left Radiant’s contracts vulnerable. Implementing time locks or requiring delayed fund transfers could provide critical reaction time in future incidents.
In response to the breach, Radiant Capital has engaged leading cybersecurity firms, including Mandiant, zeroShadow, and Hypernative. These firms assist in the investigation and asset recovery. The Radiant DAO is also collaborating with US law enforcement to trace and freeze stolen funds.
In the Medium post, Radiant also reaffirmed its commitment to sharing lessons learned and enhancing security across the DeFi industry. The DAO emphasized the importance of adopting strong governance frameworks, strengthening device-level security, and moving away from risky practices like blind signing.
“Looks like things could have stopped at step 1,” one user on X commented.
The Radiant Capital incident aligns with a recent report, which indicated how North Korean hackers continue to shift tactics. As cybercriminals grow more sophisticated, the industry must adapt by prioritizing transparency, strong security measures, and collaborative efforts to combat such attacks.
Conclusion
The Radiant Capital incident reinforces the critical need for enhanced security protocols in the DeFi space. Robust governance frameworks, comprehensive education on phishing risks, and improved transaction verification processes must be prioritized to protect against future threats. The evolving landscape of cybercrime demands vigilance and collaboration to safeguard digital assets.
