Radiant Capital Closes Doors Following Catastrophic $50 Million Malware Exploit and Prolonged Recovery Battle

CENTRALIZED DECAY: Decentralized finance (DeFi) lending protocol Radiant Capital (RDNT) has officially announced it is shutting down operations. The definitive closure comes nearly two years after a devastating $50 million cyberattack crippled the cross-chain platform, exposing critical vulnerabilities in multi-signature infrastructure and leaving developer hardware wallets fatally compromised.

The announcement marks the end of an ambitious project that once promised seamless, multi-network liquidity management, but ultimately fell victim to one of the most sophisticated supply-chain and malware-injection vectors recorded in the decentralized finance sector.

Main Facts: The Fall of a Cross-Chain Giant

Radiant Capital’s collapse underscores the persistent and evolving threat landscape facing Web3 projects, particularly those managing substantial Total Value Locked (TVL) across multiple blockchain networks.

• The Incident: In October 2024, Radiant Capital suffered a massive exploit resulting in the theft of approximately $50 million in digital assets.
• The Vector: Attackers utilized an advanced malware injection targeting the hardware wallets of core developers during a routine multi-signature (multisig) administrative operation.
• The Protocol’s Fate: Following months of attempting to restructure, recover liquidity, and restore user confidence, the protocol announced its permanent shutdown on Monday.
• Token Impact: The platform’s native token, RDNT, languished at $0.022 as market participants priced in the permanent cessation of protocol development and utility.
• The Hacker’s Gain: Onchain analytics revealed that the perpetrators successfully laundered and cashed out their loot, realizing an estimated 93.5% profit on their ill-gotten gains amid fluctuating market prices throughout 2025.

Chronology of a Crisis: From Exploit to Final Shutdown

The death knell for Radiant Capital did not ring overnight; rather, it was the culmination of a grueling, months-long post-mortem process that laid bare the limits of modern blockchain forensics and asset recovery.

October 2024: The Breach

The catastrophe unfolded during what should have been a standard, administrative procedure: a multi-signature emissions adjustment designed to optimize platform utilization rates and adapt to shifting market conditions. Instead, core developers fell victim to a silent, highly targeted device compromise.

Rather than displaying the actual parameters of the transactions being signed, the front-end interface of Safe Wallet (formerly Gnosis Safe) projected entirely legitimate transaction data. Beneath the surface, however, malicious payloads were executed concurrently, draining the protocol’s liquidity pools across multiple chains.

Late 2024 to Early 2025: The Recovery Effort

In the immediate aftermath, Radiant Capital mobilized a response team, collaborating closely with United States law enforcement agencies and specialized Web3 cybersecurity firm zeroShadow. The primary objective was twofold: identify the perpetrators and freeze stolen funds parked across various centralized and decentralized liquidity venues.

Despite swift reporting and international cooperation, the decentralized nature of the stolen assets—coupled with the speed at which the hackers utilized cross-chain bridges and privacy-enhancing mixers—severely hampered recovery efforts.

August 2025: Liquidation and Finality

Onchain tracking data compiled by blockchain analytics firm Lookonchain exposed a painful reality for the protocol’s stakeholders. The hackers had successfully converted the diverse array of stolen tokens into approximately 21,957 Ethereum (ETH).

Beginning in August 2025, as Ethereum traded at an average price of $4,562 per coin, the bad actors began systematically liquidating their holdings. This strategic cashing out yielded a staggering 93.5% profit compared to the fiat value of the assets at the time of the initial October 2024 theft, capitalizing on the broader crypto market’s recovery phases.

Faced with insurmountable financial deficits, irreparable damage to its trust profile, and an unviable path forward for its native token, leadership officially pulled the plug on Monday.

Supporting Data and Technical Breakdown

To fully understand why Radiant Capital could not survive the October 2024 breach, one must examine the mechanics of the attack and the resulting tokenomic collapse.

The Anatomy of the Safe Wallet Exploit

The exploit serves as a textbook example of advanced persistent threat (APT) behavior applied to cryptocurrency infrastructure. Security audits typically focus on smart contract logic, flash-loan vulnerabilities, and reentrancy bugs. However, the Radiant Capital attack bypassed smart contract code entirely by compromising the human-machine interface.

According to the official post-mortem released by Radiant Capital:

“The devices were compromised in such a way that the front-end of Safe Wallet (f.k.a. Gnosis Safe) displayed legitimate transaction data while poisoned transactions were signed and executed in the background. This breach occurred during a routine multi-signature emissions adjustment process, which takes place periodically to adapt to market conditions and utilization rates.”

This attack vector highlighted a terrifying blind spot in decentralized governance: even if a multi-signature wallet requires multiple independent approvals, the security of the entire treasury is compromised if the local execution environments (the hardware wallets and host machines of the signers) are silently hijacked to display deceptive UI prompts.

Market Metrics and Token Demise

The financial health of Radiant Capital was inextricably linked to the utility and market perception of its native token, RDNT.

• Pre-Hack Value: Prior to the security incident, RDNT functioned as the core incentive mechanism for liquidity providers across Arbitrum, BNB Chain, and Ethereum L2s.
• Post-Hack Decline: Following the $50 million drain, liquidity providers fled the platform en masse, precipitating a steep downward spiral in TVL.
• Final Valuation: By August 2025, as the hackers cashed out their massive ETH holdings, RDNT traded flat at a desolate $0.022, effectively rendering the token worthless for governance or yield generation purposes.

Official Responses and Stakeholder Reactions

The closure of Radiant Capital drew sharp commentary from across the decentralized finance ecosystem, with security advocates, investors, and analysts weighing in on the broader implications for protocol governance.

Web3 security firm zeroShadow, which assisted in the initial investigation, pointed out that hardware wallet security is no longer merely a matter of purchasing a cold storage device, but requires rigorous end-to-end endpoint hygiene for all administrative personnel.

Meanwhile, community reactions on social media platforms like X (formerly Twitter) reflected a mixture of resignation and frustration. Many retail users criticized the reliance on opaque multi-sig procedures that concentrate immense fiduciary power into the hands of a small group of developers whose personal workstations may lack enterprise-grade endpoint protection.

Law enforcement agencies in the United States confirmed that investigations into the origin of the malware injection remain active, though federal authorities have yet to publicly attribute the attack to a specific state-sponsored hacking syndicate or organized cybercrime group.

Implications for the DeFi Industry

Radiant Capital’s demise is far more than an isolated corporate failure; it serves as a critical inflection point for the broader decentralized finance industry. The protocol’s collapse highlights several structural challenges that Web3 must address if it hopes to achieve mainstream institutional adoption.

1. The Human Element Remains the Weakest Link

While smart contract formal verification has improved exponentially over the years, human-centric attack vectors—such as social engineering, supply-chain attacks on developer dependencies, and local environment malware—are on the rise. Protocols must adopt zero-trust architectures for all core contributors, moving beyond simple hardware wallet signing to include air-gapped signing protocols, hardware security modules (HSMs), and mandatory multi-party computation (MPC) setups with strict device isolation.

2. The Limits of Multi-Sig Transparency

The fact that a legitimate multi-sig interface could be manipulated to display false transaction data exposes a profound vulnerability in UI/UX trust assumptions. As the industry moves forward, developers are increasingly calling for independent, out-of-band transaction verification tools that allow signers to inspect raw transaction bytes on trusted, isolated hardware displays rather than relying on browser-based front-end rendering engines.

3. Cross-Chain Complexity Amplifies Risk

As a cross-chain lending protocol operating across multiple heterogeneous networks, Radiant Capital’s attack surface was inherently vast. When liquidity is bridged across diverse chains, a single administrative breach at the core layer can instantly cascade across multiple ecosystems, making containment nearly impossible once the keys are compromised.

4. The Irreversibility of Trust Loss

Perhaps the most salient lesson of Radiant Capital’s closure is the unforgiving nature of DeFi market dynamics. While traditional financial institutions can sometimes weather multi-million-dollar fraud events through bailouts, insurance, or equity restructuring, decentralized protocols rely entirely on algorithmic trust and programmatic security. Once that trust is shattered by a catastrophic exploit, and recovery efforts fail to restore user capital, the path to rehabilitation is virtually nonexistent.

As Radiant Capital winds down its remaining smart contracts and officially closes its doors, its legacy will serve as both a cautionary tale and a catalyst for tighter, more rigorous security standards across the decentralized financial frontier.