How much was lost in the Radiant Capital hack?

$50M Stolen, as publicly reported (October 16, 2024).

Who was behind the Radiant Capital hack?

Publicly attributed to Lazarus Group. ChainHint does not attribute the attacker independently — it traces the funds from the address on the public record and reports where they went.

Case Studies/Radiant Capital

Radiant Capital Hack: $50M Stolen

Q: How was the Radiant Capital hack carried out?

Malware Delivery. Three Radiant developers received a malicious PDF via Telegram — disguised as a smart contract audit from a trusted contact. The malware ran silently, compromising hardware wallet signing on the infected machines.

October 16, 2024 · Arbitrum / BNB Chain · Lazarus Group

stolen

$50M

signers compromised

3/11

Arbitrum + BNB

2 chains

group

Lazarus 🇰🇵

What happened

On October 16, 2024, Radiant Capital lost $50M in one of DeFi's most sophisticated supply-chain attacks. Three senior developers received a malware-laced PDF disguised as a smart contract audit — malware silently compromised their hardware wallets. When the developers signed what appeared to be routine multi-sig transactions, the malware invisibly altered the calldata, transferring ownership of Radiant's lending pool contracts to the attacker. $18M was drained from Arbitrum, $32M from BNB Chain. Google's Mandiant later confirmed the attack was carried out by Lazarus Group.

How the funds moved

Step 1

Malware Delivery

Three Radiant developers received a malicious PDF via Telegram — disguised as a smart contract audit from a trusted contact. The malware ran silently, compromising hardware wallet signing on the infected machines.

Step 2

Ownership Transfer

While developers signed what appeared to be routine multi-sig operations, the malware altered transaction calldata in real time. The actual transactions transferred ownership of Radiant's lending pool contracts on Arbitrum and BNB Chain to the attacker's address.

Step 3

Drain & Laundering

$18M drained from Arbitrum markets, $32M from BNB Chain. Funds converted to ETH/BNB and routed through multiple intermediary wallets. Laundering pattern consistent with previous Lazarus operations.

Key findings

Exploiter Address

0x0629…8962Primary attacker address on Arbitrum — received stolen funds via contract ownership transfer

Lazarus GroupDPRK

Attack Vector

Hardware wallet malware via PDFMalware silently modified Ledger signing UI — developers confirmed transactions they never intended to sign

Supply Chain

Affected Chains

Arbitrum ($18M) + BNB Chain ($32M)First known multi-chain simultaneous drain via hardware wallet compromise

Attribution

Lazarus Group (DPRK)Confirmed by Google Mandiant in December 2024 — identical TTPs to prior Lazarus DeFi attacks

Investigate your own incident

ChainHint traced the Radiant Capital hack in minutes.
Use the same tool for your case.