Radiant Capital Shuts Down Permanently Following Catastrophic $50M Malware Exploit

By Financial & Technology Desk
Published August 2025

Decentralized finance (DeFi) lending protocol Radiant Capital (RDNT) has officially announced its permanent shutdown, marking the tragic end of a once-promising cross-chain liquidity platform. The closure comes nearly two years after a devastating, highly sophisticated malware attack drained approximately $50 million from the protocol. Despite exhaustive recovery efforts, collaboration with federal law enforcement, and partnerships with premier blockchain security firms, Radiant Capital has been unable to recover from the architectural and financial damage inflicted by the late-2024 breach.

The collapse of Radiant Capital serves as a stark, cautionary milestone for the broader Web3 ecosystem, illuminating the persistent vulnerabilities that remain even within protocols utilizing advanced multi-signature security frameworks.

Main Facts

The definitive wind-down of Radiant Capital brings a quiet close to one of the most operationally challenging chapters in modern DeFi history.

• The Protocol: Radiant Capital operated as a decentralized cross-chain lending and borrowing market, allowing users to deposit and borrow assets across multiple disparate blockchain networks seamlessly.
• The Incident: In October 2024, malicious actors executed a sophisticated, targeted cyberattack that siphoned roughly $50 million in digital assets from the protocol’s liquidity pools.
• The Attack Vector: The exploit did not stem from a traditional smart contract vulnerability or code logic error. Instead, attackers compromised the hardware wallets of multiple core developers using advanced malware designed to deceive trusted multi-signature (multisig) interfaces.
• The Final Outcome: Unable to bridge the liquidity gap, rebuild user trust, or successfully recover the vast majority of the stolen funds, the protocol announced its permanent closure. The native utility and governance token, RDNT, languished near $0.022 as the wind-down was finalized.

Chronology of a Collapse

To understand how a prominent cross-chain protocol devolved from a high-flying DeFi contender to a shuttered platform, one must examine the timeline of events that began in October 2024 and culminated in August 2025.

October 2024: The Breach

The catastrophe unfolded during a routine operational procedure: a multi-signature emissions adjustment process. These periodic adjustments are standard practice in DeFi, designed to calibrate protocol reward rates, incentivize liquidity providers, and adapt to shifting market conditions and asset utilization rates.

However, hidden threat actors had successfully compromised the hardware wallets of several core developers prior to this routine event. Utilizing an unprecedented malware injection, the attackers manipulated the user interface (UI) of the Safe Wallet (formerly Gnosis Safe) application.

The Illusion of Safety

During the fatal signing ceremony, the hardware wallet and Safe Wallet interface displayed entirely legitimate, expected transaction data to the developers. The developers believed they were approving standard emissions adjustments.

In the background, however, the injected malware quietly intercepted the signing process, substituting the intended instructions with malicious payloads. These "poisoned" transactions were successfully signed, authorized, and executed, granting the hackers unauthorized access to transfer millions in user funds out of the protocol’s smart contracts.

Late 2024 to Mid-2025: The Laundering and Liquidation Phase

Following the exploit, Radiant Capital immediately mobilized an emergency response. The team engaged United States law enforcement agencies, including federal cybercrime units, and partnered with prominent Web3 security and intelligence firm zeroShadow. The objective was clear: trace the stolen funds, flag tainted addresses, and pressure centralized exchanges to freeze any incoming deposits.

Despite these concerted efforts, the decentralized nature of the assets and the technical sophistication of the attackers hindered recovery operations. Onchain analytics firm Lookonchain revealed that the hacker successfully moved the stolen capital through various privacy protocols and cross-chain bridges.

By August 2025, the attacker had completely converted the remaining stolen cache into approximately 21,957 Ethereum (ETH). Capitalizing on subsequent market conditions, the hacker began liquidating these holdings at an average price of $4,562 per ETH, walking away with an estimated 93.5% profit on their initial illicit loot.

August 2025: The Final Curtain

Recognizing the insurmountable deficit in protocol liquidity, the ongoing erosion of investor confidence, and the inability to restore normal operations, the core contributors and governance participants of Radiant Capital made the inevitable decision to shut down the protocol entirely.

Supporting Data and Financial Metrics

The quantitative fallout of the Radiant Capital exploit and subsequent shutdown highlights the unforgiving economic realities of the decentralized finance sector:

• Total Value Drained: ~$50,000,000 USD (at the time of the October 2024 exploit).
• Stolen Funds Converted: ~21,957 ETH.
• Liquidation Value: Liquidated by the hacker in August 2025 at an average price of $4,562 per ETH.
• Hacker ROI: Approximately 93.5% net profit realized on the stolen digital assets following the crypto market’s upward trajectory through 2025.
• Token Valuation: Radiant Capital’s native token, RDNT, cratered to a nominal price of $0.022 by August 2025, reflecting near-total loss of market capitalization and utility.

Official Responses and Post-Mortem Analysis

In the wake of the breach, Radiant Capital transparently published a detailed post-mortem to inform the broader Web3 community of the exact mechanics behind the hack.

The official statement released by the protocol read:

"The devices were compromised in such a way that the front-end of Safe Wallet (f.k.a. Gnosis Safe) displayed legitimate transaction data while poisoned transactions were signed and executed in the background. This breach occurred during a routine multi-signature emissions adjustment process, which takes place periodically to adapt to market conditions and utilization rates."

Security analysts reviewing the incident emphasized that the exploit bypassed standard multi-signature safeguards—widely considered the gold standard for institutional and protocol treasury management—by attacking the endpoint devices (the developers’ hardware wallets) rather than the cryptographic logic of the smart contracts themselves.

Security firm zeroShadow noted that standard cybersecurity hygiene is no longer sufficient for individuals holding administrative keys to multi-million-dollar protocols. The ability of modern malware to hijack the visual feedback loop of hardware wallets represents a quantum leap in social engineering and endpoint exploitation.

Broader Implications for the DeFi Industry

The demise of Radiant Capital is more than an isolated corporate failure; it serves as a watershed moment for the entire decentralized finance industry, carrying profound implications for security, governance, and user trust.

1. The Death of the "Smart Contract Only" Security Paradigm

For years, DeFi audits and risk assessments focused overwhelmingly on smart contract code vulnerability analysis—checking for reentrancy bugs, flash loan attack vectors, and arithmetic overflows. The Radiant hack proves that protocols are only as secure as their weakest operational link. Endpoint security, developer device integrity, and local machine hygiene are now recognized as critical attack surfaces that demand the same level of rigorous auditing as core protocol code.

2. The Vulnerability of Multisig Interfaces

Safe Wallet (formerly Gnosis Safe) is utilized by the vast majority of DAOs, treasuries, and DeFi protocols across Ethereum, Arbitrum, Optimism, and other networks. The revelation that attackers could successfully trick a developer into signing a malicious payload while the UI showed benign data exposed a terrifying vulnerability in how humans interact with Web3 signing environments. Hardware wallets with "blind signing" vulnerabilities or compromised host machines can render multi-signature quorum systems entirely ineffective.

3. The Limits of Law Enforcement and Onchain Recovery

Despite immediate reporting to federal law enforcement and collaboration with top-tier blockchain intelligence firms, the Radiant Capital case underscores the persistent difficulty of recovering assets once they enter sophisticated laundering pipelines. While cross-chain tracking has improved exponentially, decentralized mixers, cross-chain bridges, and decentralized exchanges (DEXs) continue to offer sophisticated threat actors viable avenues to cash out stolen funds.

4. Market Consequence: Flight to Quality and Centralization Pressures

Incidents like the Radiant Capital shutdown weigh heavily on the psychological sentiment of retail and institutional investors alike. Repeated exploits driven by sophisticated endpoint compromises accelerate a broader trend: capital retreating from experimental, highly complex cross-chain protocols and concentrating within battle-tested, highly liquid blue-chip DeFi platforms. Furthermore, such high-profile failures provide regulatory bodies with ammunition to argue for stricter oversight, compliance mandates, and heavier surveillance across the decentralized asset landscape.

Conclusion

Radiant Capital’s journey from a pioneering cross-chain lending hub to a casualty of advanced cybercrime illustrates both the immense potential and the brutal risks inherent in decentralized finance. As the protocol winds down its operations for the final time, its legacy will not be its innovative lending mechanisms, but rather the hard lessons it leaves behind regarding endpoint security, operational transparency, and the imperative need for infallible multi-signature governance frameworks. For the rest of the DeFi ecosystem, the shutdown of RDNT is an urgent reminder that protecting user capital requires securing every single human and device in the operational chain.