Azoundria: Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/radiantcapitalgnosissafewalletmalware.php}} {{Unattributed Sources}} Radiant Capital Logo/HomepageRadiant Capital is a decentralized autonomous organization which has a goal to unify fragmented liquidity across various money market protocols. Users who provide their capital can expect to earn a portion of the generated fees. Radiant Capital thought it w..."

2024-10-18T19:04:03Z

Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/radiantcapitalgnosissafewalletmalware.php}} {{Unattributed Sources}} thumb|Radiant Capital Logo/HomepageRadiant Capital is a decentralized autonomous organization which has a goal to unify fragmented liquidity across various money market protocols. Users who provide their capital can expect to earn a portion of the generated fees. Radiant Capital thought it w..."

New page

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/radiantcapitalgnosissafewalletmalware.php}}
{{Unattributed Sources}}

[[File:Radiantcapital.jpg|thumb|Radiant Capital Logo/Homepage]]Radiant Capital is a decentralized autonomous organization which has a goal to unify fragmented liquidity across various money market protocols. Users who provide their capital can expect to earn a portion of the generated fees. Radiant Capital thought it would be a good idea to manage routine smart contract transactions through blind signing on hardware wallets with full permissions. Attackers reportedly "exploited multiple developers' hardware wallets through a highly advanced malware injection". Radiant Capital has thus far released a post-mortem report and there haven't yet been any discussions on recovery for users, other than from tracing down the funds, thus far.<ref name="rektnews-16165" /><ref name="archive-16166" /><ref name="radiant-16167" /><ref name="rekthqtwitter-16168" /><ref name="anciliainctwitter-16169" /><ref name="bscscan-16170" /><ref name="arbiscan-16171" /><ref name="anciliainctwitter-16172" /><ref name="rdntcapitailtwitter-16173" /><ref name="radiantdocs-16174" /><ref name="rdntcapitaltwitter-16175" /><ref name="rdntcapitaltwitter-16176" /><ref name="rdntcapitaltwitter-16177" /><ref name="rdntcapitaltwitter-16178" /><ref name="zeroshadow-16179" /><ref name="safeapp-16180" /><ref name="radiantcapitalmedium-16181" />

== About Radiant Capital ==
"The Radiant DAO’s mission is to unify the billions in fragmented liquidity across Web3 money markets under one safe, user-friendly, capital-efficient omnichain protocol."

"Earn Interest & Borrow Assets Cross-Chain, Seamlessly" "Dynamic liquidity providers share platform fees captured in blue-chip assets"

"Battle-tested and audited by multiple leading security firms. Radiant's security is of the highest priority."

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
"Radiant Capital's future has dimmed following" "devastating attack that drained over $53 million from user wallets."
{| class="wikitable"
|+Key Event Timeline - Radiant Capital Gnosis Safe Wallet Malware
!Date
!Event
!Description
|-
|October 16th, 2024 11:09:18 AM MDT
|Arbitrum Exploit Transaction
|A transaction exploits to transfer ownership of the Arbitrum smart contract to the attacker.
|-
|October 16th, 2024 11:11:00 AM MDT
|BNB Back Door Smart Contract
|According to Ancilia, this is the time when a backdoor smart contract was deployed to drain funds.
|-
|October 16th, 2024 11:35:00 AM MDT
|Ancilia Mentions Exploit
|Ancilia Inc. notes that there are several transfers from the contracts and warns users to revoke approvals to Radiant Capital quickly.
|-
|October 16th, 2024 12:24:00 PM MDT
|Ancilia Mentions Arbitrum
|Ancilia acknowledges that there was an attack on the ARbitrum blockchain as well.
|-
|October 16th, 2024 1:27:00 PM MDT
|Radiant Capital Acknowledgement
|Radian Capital acknowledges the exploit on Binance Smart Chain and Arbitrum blockchains. They report to be "working with SEAL911, Hypernative, ZeroShadow & Chainalysis". They have also reportedly paused markets on base and mainnet.
|-
|October 16th, 2024 1:30:00 PM MDT
|Revoke Approvals Assistance
|Scammers set up a phishing site to help users who want to revoke approvals have less assets to worry about going forward.
|-
|October 16th, 2024 4:04:00 PM MDT
|Real Revoke Instructions
|Radiant Capital provides instructions for users to revoke approvals to 4 exploited contracts via the commonly used website revoke.cash.
|-
|October 17th, 2024 9:54:00 AM MDT
|Rekt Investigation Posted
|Rekt posts their investigation on their website and on Twitter.
|-
|October 17th, 2024 9:26:00 PM MDT
|Public Statement Released
|The Radiant Capital team releases a public statement highlighting the vulnerability and how the legitimate transaction data showed up in their Gnosis Safe wallets. Their team believed they were signing a legitimate transaction and performed all checks that they typically would, including
|-
|October 17th, 2024 9:43:00 PM MDT
|FBI To US Law Enforcement
|Radiant Capital updates their post to replace "FBI" with US law enforcement. It is unclear if the FBI was the agency informed or not.
|}

== Technical Details ==
Attackers reportedly "exploited multiple developers' hardware wallets through a highly advanced malware injection". The breach reportedly "occurred during a routine multi-signature emissions adjustment process, which takes place periodically to adapt to market conditions and utilization rates."

"Front-end verification of all three multi-signature transactions showed no signs of compromise, aside from Safe App transaction resubmissions due to failures. It is important to highlight that resubmitting Safe transactions due to failures is a common and expected occurrence. Transactions submitted on the Safe front-end can fail due to gas price fluctuations, nonce mismatch, network congestion, insufficient gas limit, smart contract execution errors, token insufficiency, pending transactions, front-end synchronization issues, timeouts, or permission/signature errors in multi-signature setups. As a result, this behavior did not raise immediate suspicion. The malicious actors exploited this normalcy, using the process to collect multiple compromised signatures over several attempts, all while mimicking the appearance of routine transaction failures."

"To underscore the significance of this point, the compromise was completely undetectable during the manual review of the Gnosis Safe UI and Tenderly simulation stages of the routine transaction. This has been confirmed by external security teams, including @_SEAL_Org and @HypernativeLabs."

"Compromised wallets
0x20340c2a71055FD2887D9A71054100FF7F425BE5 (Ledger hardware wallet managed via Rabby)
0x83434627e72d977af18F8D2F26203895050eF9Ce (Ledger hardware wallet managed via Rabby)
0xbB67c265e7197A7c3Cd458F8F7C1d79a2fb04d57 (Trezor hardware wallet managed via Frame)
Admin multisig wallets and signature threshold (at time of exploit)
Ethereum: 0x0235a22a38Dd09291800e097bD2ebE6e3b4d5F04 (3/9)
BSC Chain: 0xE4714D6BD9a6c0F6194C1aa8602850b0a1cE1416 (3/11)
Base: 0xBBf7eDF92926b775A434f9DF15860f4CD268B0A0 (3/9)
Arbitrum: 0x111CEEee040739fD91D29C34C33E6B3E112F2177 (3/11)
Known attackers wallets
0x0629b1048298AE9deff0F4100A31967Fb3f98962 (Main attacker)
0x57ba8957ed2ff2e7ae38f4935451e81ce1eefbf5 (Main attack contract)
0x911215CF312a64C128817Af3c24B9fDF66B7Ac95 (Testing address)
0x97a05becc2e7891d07f382457cd5d57fd242e4e8 (Laundering address)
0x9c5939AAC4f65A0eA233E657507C7b54acDE2841 (Laundering address)
0x8B75E47976C3C500D0148463931717001F620887 (Funds consolidated on Arb + Eth)
0xcF47c058CC4818CE90f9315B478EB2f2d588Cc78 (Funds consolidated on BSC)
0xa0e768a68ba1bfffb9f4366dfc8d9195ee7217d1 (GMX interactions / swaps)
0xc24927Bd40Bab67CcfB2ca0A90d6cbB8Edb21302 (Approvals drainer on Arbitrum)
0x579145D6d1F26a460d9BDD3040C37517dac379ac (Approvals drainer on BSC)
0xC4173a794122644870C8fd07c226acF992507897 (Approvals drainer on BSC + ARB)
0x3D4C56cdB97355807157F5C7d4F54957f0E9af44 (Contract created on 17th October)
0x3c09Ae8571db07a3347c1D577BB9a54F96bFfa24 (Contract created on 17th October)
0xbc20e84d80a684dAEa4468be6F199a233A3d2363 (Test contract)
0x5eb63694A18B618C4EbDd9CA3333fa7f9b8B9cB4 (Related to test contract)
0xD899F3d8ff2A723642d5C55eD1998713C530b7b3 (Related to test contract)"

== Total Amount Lost ==
53m or 48m or 50m depending on source?

The total amount lost has been estimated at $53,000,000 USD.

== Immediate Reactions ==
"#ancilia_alerts It seems like something happen with @RDNTCapital contract on BSC. We have noticed several transferFrom user's account through the contract 0xd50cf00b6e600dd036ba8ef475677d816d6c4281. Please revoke your approval ASAP. It seems like the new implementation had vulnerability functions."

== Ultimate Outcome ==
"Radiant Capital has been working very closely with Seal911 and Hypernative and has since implemented stronger multisig controls. The U.S. law enforcement and @zeroshadow_io are fully informed of the breach and are actively working to freeze all stolen assets. The DAO is deeply devastated by this attack and will continue to work tirelessly with the respective agencies to identify the exploiter and recover the stolen funds as quickly as possible."

"The DAO has been working very closely with U.S. law enforcement and ZeroShadow and maintain an excellent relationship with both groups. They are fully informed of the breach and are actively working to freeze all stolen assets. The DAO is deeply devastated by this attack and will continue to remain available 24/7 to assist the respective agencies working to identify the exploiter and recover the stolen funds as quickly as possible."

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="rektnews-16165">[https://rekt.news/radiant-capital-rekt2/ Rekt - Radiant Capital - Rekt II] (Accessed Oct 18, 2024)</ref>

<ref name="archive-16166">[https://archive.ph/XWAUF https://archive.ph/XWAUF] (Accessed Oct 18, 2024)</ref>

<ref name="radiant-16167">[https://radiant.capital/ Radiant] (Accessed Oct 18, 2024)</ref>

<ref name="rekthqtwitter-16168">[https://twitter.com/RektHQ/status/1846942869799469566 @RektHQ Twitter] (Accessed Oct 18, 2024)</ref>

<ref name="anciliainctwitter-16169">[https://twitter.com/AnciliaInc/status/1846605867753591002 @AnciliaInc Twitter] (Accessed Oct 18, 2024)</ref>

<ref name="bscscan-16170">[https://bscscan.com/tx/0xd97b93f633aee356d992b49193e60a571b8c466bf46aaf072368f975dc11841c BNB Smart Chain Transaction Hash (Txhash) Details | BscScan] (Accessed Oct 18, 2024)</ref>

<ref name="arbiscan-16171">[https://arbiscan.io/tx/0x7856552db409fe51e17339ab1e0e1ce9c85d68bf0f4de4c110fc4e372ea02fb1 Arbitrum One Transaction Hash (Txhash) Details | Arbitrum One] (Accessed Oct 18, 2024)</ref>

<ref name="anciliainctwitter-16172">[https://twitter.com/AnciliaInc/status/1846618258163761551 @AnciliaInc Twitter] (Accessed Oct 18, 2024)</ref>

<ref name="rdntcapitailtwitter-16173">[https://twitter.com/RDNTCapitail/status/1846634774674514326 @RDNTCapitail Twitter] (Accessed Oct 18, 2024)</ref>

<ref name="radiantdocs-16174">[https://docs.radiant.capital/radiant/radiantv2 Introducing Radiant v2 | Radiant 2.0] (Accessed Oct 18, 2024)</ref>

<ref name="rdntcapitaltwitter-16175">[https://twitter.com/RDNTCapital/status/1846634050100039881 @RDNTCapital Twitter] (Accessed Oct 18, 2024)</ref>

<ref name="rdntcapitaltwitter-16176">[https://twitter.com/RDNTCapital/status/1847116913672868018 @RDNTCapital Twitter] (Accessed Oct 18, 2024)</ref>

<ref name="rdntcapitaltwitter-16177">[https://twitter.com/RDNTCapital/status/1846673545973432333 @RDNTCapital Twitter] (Accessed Oct 18, 2024)</ref>

<ref name="rdntcapitaltwitter-16178">[https://twitter.com/RDNTCapital/status/1847121278974480779 @RDNTCapital Twitter] (Accessed Oct 18, 2024)</ref>

<ref name="zeroshadow-16179">[https://www.zeroshadow.io/ HOME | zeroShadow] (Accessed Oct 18, 2024)</ref>

<ref name="safeapp-16180">[https://app.safe.global/welcome Safe{Wallet} – Welcome] (Accessed Oct 18, 2024)</ref>

<ref name="radiantcapitalmedium-16181">[https://medium.com/@RadiantCapital/radiant-post-mortem-fecd6cd38081 Radiant Capital Post-Mortem. Events Summary | by Radiant Capital | Oct, 2024 | Medium] (Accessed Oct 18, 2024)</ref></references>

Radiant Capital Gnosis Safe Wallet Malware - Revision history