The post Radiant Capital Suffers $50M Loss in DeFi Cyberattack Linked to North Korea appeared on BitcoinEthereumNews.com.

Radiant Capital suffered a $50M loss in a cyberattack attributed to the DPRK-linked UNC4736 group. Attackers used sophisticated malware and social engineering to bypass security protocols. The incident highlights critical vulnerabilities in DeFi security, urging the adoption of hardware-level transaction verification across the industry. Radiant Capital has confirmed new findings surrounding the devastating $50 million cyberattack it suffered on October 16, 2024. An investigation by cybersecurity firm Mandiant identified the attackers as UNC4736, a North Korea-linked threat group connected to the nation’s Reconnaissance General Bureau (RGB). This is another alarming rise in the sophistication of cyberattacks targeting decentralized finance (DeFi), showing the urgent need for stronger security measures in the industry. How the Attack Unfolded The attack was set in motion on September 11, 2024, when a Radiant developer received a seemingly normal Telegram message from someone posing as a former contractor. The message had a ZIP file, supposedly showcasing the contractor’s work in smart contract auditing. But it contained a sophisticated malware called INLETDRIFT. This malware, disguised as a legitimate PDF file, established a macOS backdoor on the victim’s device and connected it to an external domain controlled by the attackers. Over subsequent weeks, UNC4736 deployed malicious smart contracts across Arbitrum, Binance Smart Chain, Base, and Ethereum, meticulously planning the heist. Although Radiant followed standard security protocols, such as transaction simulations using Tenderly and payload verification, the attackers used vulnerabilities in front-end interfaces to manipulate transaction data. By the time the theft happened, the hackers had concealed their actions well, making detection nearly impossible. Attribution and Tactics UNC4736, also known as AppleJeus or Citrine Sleet, is a well-known threat group linked to DPRK’s TEMP.Hermit. The group focuses on cyber financial crimes, often using highly advanced social engineering techniques to infiltrate systems. Mandiant attributes this attack to the group with…

---

Filed under: News - @ December 7, 2024 3:21 pm