Radiant Capital · 2024-10
In October 2024, Radiant Capital lost more than $53 million after attackers compromised multiple developer devices and manipulated multisig transaction signing. Radiant later said the operation began with a September 2024 Telegram lure impersonating a trusted former contractor, delivered the INLETDRIFT macOS backdoor, and caused front-end interfaces to show benign transaction data while malicious transactions were signed in the background; Mandiant attributed the activity to DPRK-nexus UNC4736/AppleJeus/Citrine Sleet.
The North Korean Hacker Group Citrine Sleet Stole $51.5 Million from Radiant Capital Loan Protocol Users by Exploiting Smart Contract Vulnerabilities on 16 October 2024 · 16.10.2024
On 16 October 2024, the North Korean hacker group Citrine Sleet exploited a series of vulnerabilities in the smart contracts of the Radiant Capital loan protocol, manipulating smart contracts on two blockchains, BNB Smart Chain and Arbitrum, and gaining access to three private keys of signatories to a multi-signing wallet, which controlled the functions of the protocol, resulting in the theft of about $51.5 million from protocol users. The attack was initially reported by De.Fi, another security company, who warned users of the attack through a post on X, clarifying that changes to smart contracts had taken place fraudulently. In response to the attack, security company Ancilia inadvertently posted a link to a wallet drainer, while trying to assist victims, which was promptly removed after the community noticed the error. The incident was widely reported and commented on by security experts, who highlighted the importance of clear and transparent information by security companies, and the need for a strict verification protocol and responsible communications. Radiant Capital claimed to be aware of the problem and took steps to cooperate with several security experts, including Mandiant, SEAL911, Hyperactive, ZeroShadow and Chainalysis, to investigate and resolve the crisis. On 6th December, the Radiant Capital released a summary of the technical report by Mandiant on Medium including an attribution of the attack to the North Korean hacker group Citrine Sleet.
Radiant links $50 million crypto heist to North Korean hackers · 2024-10
Radiant links $50 million crypto heist to North Korean hackers
https://www.bleepingcomputer.com/news/security/radiant-links-50-million-crypto-heist-to-north-korean-hackers/
Radiant Capital · 2024-10-17
Table 2: DPRK Cryptocurrency Thefts, January - December, 2024. Date: 2024-10-17; Victim: Radiant Capital; DPRK APT: Citrine Sleet; Amount ($ Million): 50. Report: "In coordination with Chainalysis and Mandiant, MSMT Participating States have attributed the cryptocurrency heists in tables 2 and 3 to DPRK actors."
Radiant Capital · last year (2024)
The United States and Republic of Korea additionally attribute to the DPRK, based on detailed industry analysis, thefts last year against WazirX for $235 million and Radiant Capital for $50 million.
Radiant Capital exploit (malware-laced PDF sent to engineers) · published 2025-01-01
Meanwhile, Radiant's exploit involved sending a malware-laced PDF to company engineers, allowing attackers to compromise multiple developer devices.
Radiant Capital (INLETDRIFT malware via Telegram lure) · October 2024
(MSMT/2025/2, report p. 33) “Citrine Sleet is responsible for the theft of $50 million from Radiant Capital in October 2024. ... The Citrine Sleet actor posed as a trusted former contractor ... Within the ZIP file, the Citrine Sleet actor delivered INLETDRIFT malware, which established a persistent macOS backdoor while displaying a PDF file to the user. The malware used a malicious AppleScript routine to communicate with the domain atokyonews[.]com.” (see also Annex 3)