Radiant Capital Shuts Down Permanently, Ending DeFi Saga Following Catastrophic $50 Million Exploit
By Financial News Desk
Decentralized finance (DeFi) lending protocol Radiant Capital (RDNT) has officially announced it is shutting down its operations. The decision comes nearly two years after the platform fell victim to a sophisticated cyberattack that drained approximately $50 million in user funds.
The wind-down marks a sobering milestone for the cross-chain liquidity market, which once boasted significant Total Value Locked (TVL) across multiple blockchain networks. Despite extensive post-hack recovery efforts involving global law enforcement agencies and specialized Web3 security firms, the protocol has deemed it impossible to recover from the architectural damage, reputational loss, and financial deficit inflicted by the late-2024 breach.
Main Facts: The End of a Promising Cross-Chain Protocol
Radiant Capital’s announcement to permanently shutter its operations signals the ultimate casualty of an increasingly complex threat landscape facing decentralized applications (dApps). At its peak, Radiant was designed to unify fragmented liquidity across disparate blockchain ecosystems, allowing users to deposit and borrow assets seamlessly across multiple networks.
However, the protocol’s architecture—specifically its reliance on multi-signature (multisig) authorization governance structures—proved vulnerable to a highly targeted attack vector. The October 2024 exploit did not target smart contract logic flaws, which are the traditional hunting grounds for decentralized finance hackers; instead, it bypassed the human and hardware layer through advanced malware.
- Total Stolen Funds: ~$50 million
- Primary Attack Vector: Advanced malware injection targeting developer hardware wallets
- Affected Tooling: Safe Wallet (formerly Gnosis Safe) front-end interface manipulation
- Token Impact: Native token RDNT languishing at approximately $0.022
- Attacker Action: Conversion of stolen capital into 21,957 ETH, later liquidated at an average of $4,562 per coin
Chronology of a Heist: From Breach to Liquidation
To understand how Radiant Capital arrived at its ultimate demise, it is necessary to examine the timeline of events that began in the fall of 2024 and culminated in the platform’s closure.
October 2024: The Sophisticated Compromise
The genesis of Radiant’s collapse occurred during a routine administrative procedure. Developers were executing a multi-signature emissions adjustment process—a standard administrative task designed to modify reward distributions and adapt to shifting market conditions and platform utilization rates.
Unbeknownst to the multi-sig signers, multiple core developers’ hardware wallets had been infected with a highly sophisticated strain of malware. This malicious code manipulated the presentation layer of the Safe Wallet interface. While the hardware device screens and user interfaces displayed completely legitimate transaction parameters, malicious, poisoned payloads were surreptitiously signed and executed in the background.
Late 2024 to Mid-2025: The Recovery and Tracking Phase
In the immediate aftermath of the exploit, Radiant Capital mobilized an emergency response. The core team partnered with prominent Web3 security and intelligence firm zeroShadow, alongside federal and international law enforcement agencies, to trace and freeze the stolen assets.
Despite these collaborative efforts, decentralized finance exploits inherently present monumental hurdles for asset recovery. Blockchain analytics firm Lookonchain closely monitored the movement of the stolen funds. On-chain data revealed that the attacker successfully bypassed initial containment protocols by routing the capital through privacy-enhancing protocols and cross-chain bridges.
August 2025: Conversion and Cash-Out
By August 2025, the hacker had completely restructured the stolen portfolio. On-chain metrics showed that the illicitly acquired funds had been consolidated and converted into approximately 21,957 Ethereum (ETH).
Capitalizing on favorable market conditions, the attacker began aggressively dumping the accumulated Ether on the open market at an average price of $4,562 per coin. Analysts estimate that through strategic timing and market appreciation, the perpetrator secured an astonishing 93.5% profit on their initial loot, leaving victims and stakeholders with virtually no recourse for capital restitution.
Supporting Data: Token Metrics and Market Fallout
The macroeconomic reality for Radiant Capital grew increasingly grim as the months following the exploit dragged on. Decentralized finance protocols heavily rely on native token utility and market confidence to bootstrap liquidity, incentivize participation, and govern protocol upgrades.
The Collapse of RDNT
Prior to the October 2024 security breach, Radiant’s native governance and utility token, RDNT, served as the bedrock of the ecosystem’s incentive models. Following the hack, trading volume plummeted, liquidity pools dried up, and market makers abandoned the asset.
By August 2025, RDNT was trading at a desolate $0.022, representing a near-total wipeout of its historical market capitalization. The devaluation crippled any theoretical governance-led bailouts or community-driven treasury recoveries, rendering the protocol economically unviable.
Protocol TVL and User Exodus
Total Value Locked (TVL)—the definitive metric of health for any DeFi lending market—evaporated almost overnight in late 2024. Users rushed to withdraw their uncompromised collateral, turning a liquidity protocol into a ghost town. Without sufficient TVL to generate protocol revenue or sustain lending and borrowing demand, the core contributors determined that keeping the infrastructure online posed unnecessary ongoing administrative and operational liabilities.
Official Responses: Accountability and Post-Mortem Analysis
Following the breach, Radiant Capital published a comprehensive post-mortem detailing the mechanics of the attack to warn the broader Web3 ecosystem.
The official transparency report stated:
"The devices were compromised in such a way that the front-end of Safe Wallet (f.k.a. Gnosis Safe) displayed legitimate transaction data while poisoned transactions were signed and executed in the background. This breach occurred during a routine multi-signature emissions adjustment process, which takes place periodically to adapt to market conditions and utilization rates."
The disclosure sent shockwaves through the institutional and retail crypto communities, as Safe Wallet is widely considered the industry gold standard for securing treasury funds and multi-signature operations. Security researchers later emphasized that the vulnerability did not stem from a flaw in Safe’s smart contracts, but rather from an advanced endpoint compromise of the individual signers’ hardware environments—highlighting the vulnerability of human endpoints in otherwise cryptographically secure systems.
Implications for the Future of Decentralized Finance
The permanent shutdown of Radiant Capital serves as a case study for the decentralized finance industry, carrying profound implications for protocol security, developer hygiene, and institutional adoption.
1. The Human Element as the Ultimate Attack Vector
While early DeFi exploits frequently targeted sloppy smart contract code (such as reentrancy bugs or flash loan price oracle manipulation), hackers have increasingly shifted their focus upstream. By targeting the human beings and endpoint devices maintaining protocols—such as core developers, infrastructure maintainers, and DAO administrators—bad actors can bypass immutable code entirely. The Radiant exploit underscores that a smart contract is only as secure as the private keys and hardware devices used to govern it.
2. Rethinking Multisig Governance and UI Trust
The reliance on visual user interfaces (UIs) to verify complex multi-signature transactions represents a systemic risk. When front-ends can be subverted by localized endpoint malware to display fraudulent transaction details while extracting cryptographic approvals in the background, traditional "blind signing" prevention methods fall short. The industry is now forced to accelerate the adoption of native hardware-level transaction parsing, where signing devices independently decode and display raw transaction byte-code in human-readable formats independent of web browsers or application front-ends.
3. The Limits of Law Enforcement and On-Chain Recovery
Radiant’s inability to recover the stolen capital—despite enlisting specialized security firms like zeroShadow and collaborating with law enforcement—illustrates the enduring difficulty of asset recovery in decentralized ecosystems. Once hackers successfully obfuscate funds through decentralized exchanges, privacy mixers, or cross-chain bridges, reclaiming stolen user capital remains an uphill battle with a low statistical success rate.
4. Consolidation and Compliance Pressures
As protocols like Radiant Capital fold under the weight of exploits and regulatory scrutiny, the broader DeFi landscape is undergoing a painful consolidation. Users and capital are increasingly migrating toward heavily audited, blue-chip protocols with institutional-grade insurance backstops and rigorous operational security frameworks.
For Radiant Capital, the final sunsetting brings closure to a protracted chapter of loss, reminding the decentralized economy that security in Web3 is a continuous, multi-layered discipline where a single compromised endpoint can unravel years of innovation.
