Radiant Capital's multisig signers were tricked by malware into approving malicious contract upgrades, resulting in $58M stolen.
Three Radiant Capital multisig signers had their hardware wallets compromised via sophisticated malware. The malware intercepted signing requests, displaying legitimate-looking transaction data on screen while actually signing a malicious contract upgrade. The upgraded contracts contained backdoors allowing the attacker to drain lending pools.
Stolen funds moved cross-chain via bridges. ETH portion deposited into Tornado Cash. Token assets converted to ETH via aggregators before mixing. Lazarus Group attributed as responsible by US government advisories. Radiant Capital partnered with Mandiant and law enforcement but no recoveries made.
0xd9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e