North Korean Group UNC4736 Blamed for Radiant Capital Breach

On October 16, 2024, Radiant Capital, a decentralized cross-chain lending protocol built on LayerZero, was the victim of a highly sophisticated cyberattack that resulted in a staggering $50 million loss.

The attack has since been linked to North Korean hackers, marking another alarming chapter in the growing wave of cybercrime targeting decentralized finance (DeFi).

Report Links North Korean Actors to Radiant Capital Incident

A report from OneKey, a Coinbase-backed crypto hardware wallet manufacturer, attributed the attack to North Korean hackers. The report extends from a recent medium post shared by Radiant Capital, which provided an incident update on the October 16 attack.

Reportedly, Mandiant, a leading cybersecurity firm, further linked the breach to UNC4736, a DPRK-aligned group also known as AppleJeus or Citrine Sleet. This group operates under the Reconnaissance General Bureau (RGB), North Korea’s primary intelligence agency.

Mandiant’s investigation revealed that the attackers meticulously planned their operation. They staged malicious smart contracts across multiple blockchain networks, including Arbitrum, Binance Smart Chain, Base, and Ethereum. These efforts reflect the advanced capabilities of DPRK-backed threat actors in targeting the DeFi sector.

The breach began with a calculated phishing attack on September 11, 2024. A Radiant Capital developer received a Telegram message from an individual impersonating a trusted contractor. The message included a zip file purportedly containing a smart contract audit report. This file, “Penpie_Hacking_Analysis_Report.zip,” was laced with malware known as INLETDRIFT, a macOS backdoor that facilitated unauthorized access to Radiant’s systems.

When the developer opened the file, it appeared to contain a legitimate PDF. However, the malware silently installed itself, establishing a backdoor connection to a malicious domain at atokyonews[.]com. This allowed the attackers to spread the malware further among Radiant’s team members, gaining deeper access to sensitive systems.

The hackers’ strategy culminated in a man-in-the-middle (MITM) attack. By exploiting compromised devices, they intercepted and manipulated transaction requests within Radiant’s Gnosis Safe Multisig wallets. While transactions appeared legitimate to developers, the malware covertly altered them to execute a transfer Ownership call, seizing control of Radiant’s lending pool contracts.

Execution of the Heist, Industry Implications, and Lessons Learned

Despite Radiant’s adherence to best practices, such as using hardware wallets, transaction simulations, and verification tools, the attackers’ methods bypassed all defenses. Within minutes of securing ownership, the hackers drained funds from Radiant’s lending pools, leaving the platform and its users reeling.

The Radiant Capital hack serves as a stark warning to the DeFi industry. Even projects adhering to rigorous security standards can fall prey to sophisticated threat actors. The incident highlighted critical vulnerabilities, including:

• Phishing Risks: The attack began with a convincing impersonation scheme, emphasizing the need for heightened vigilance against unsolicited file sharing.
• Blind Signing: While essential, hardware wallets often display only basic transaction details, making it difficult for users to detect malicious modifications. Improved hardware-level solutions are necessary to decode and validate transaction payloads.
• Front-End Security: The reliance on front-end interfaces for transaction verification proved inadequate. Spoofed interfaces enabled hackers to manipulate transaction data undetected.
• Governance Weaknesses: The absence of mechanisms to revoke ownership transfers left Radiant’s contracts vulnerable. Implementing time locks or requiring delayed fund transfers could provide critical reaction time in future incidents.

In response to the breach, Radiant Capital has engaged leading cybersecurity firms, including Mandiant, zeroShadow, and Hypernative. These firms assist in the investigation and asset recovery. The Radiant DAO is also collaborating with US law enforcement to trace and freeze stolen funds.

In the Medium post, Radiant also reaffirmed its commitment to sharing lessons learned and enhancing security across the DeFi industry. The DAO emphasized the importance of adopting strong governance frameworks, strengthening device-level security, and moving away from risky practices like blind signing.

“Looks like things could have stopped at step 1,” one user on X commented.

The Radiant Capital incident aligns with a recent report, which indicated how North Korean hackers continue to shift tactics. As cybercriminals grow more sophisticated, the industry must adapt by prioritizing transparency, strong security measures, and collaborative efforts to combat such attacks.