Radiant Capital Hack

Radiant Capital was a lending protocol that let users deposit and borrow tokens on Arbitrum, BNB Chain, Ethereum and Base. Weeks before the attack, hackers posing as a former contractor sent malware over Telegram and infected the devices of three core developers. On 16 October 2024, when these developers signed what looked like a routine transaction on Radiant's multisig, they were actually signing one that handed control of the lending pools to the attackers. Radiant and the security firm Mandiant later linked the attack to a hacking group tied to North Korea.

The attackers upgraded the lending pools on Arbitrum and BNB Chain with malicious code that emptied them and, three minutes later, began pulling tokens from every wallet that still had an approval for them. About $50M came out of the pools and a further $10M out of user wallets through approvals. The pools on Ethereum and Base were never upgraded and lost nothing. Radiant set up a plan to repay lost deposits over time, but a DAO proposal to also compensate approval losses did not pass. In June 2026, Radiant announced it was winding down.

The malicious code is still installed on the Arbitrum and BNB Chain pools and is still being used. Wallets were drained as recently as July 2026, and tens of thousands of approvals remain live. Radiant advised revoking approvals on all four chains, including Ethereum and Base. Since approval losses are not being compensated, revoking is the only protection. If you ever used Radiant, revoke every approval to its lending pools now. Revoking does not recover tokens that were already taken.

Affected users remain at risk as long as they haven't revoked their approvals, so it is recommended to use the Revoke.cash Exploit Checker below to make sure that you're safe.