16 Oct 2024, from ~15:46 UTC
Radiant Capital: Compromised Devices Signed Malicious Safe Ownership Transfer
Radiant: on 16 Oct 2024 malware on at least three developers' devices collected Safe{Wallet} signatures that transferred LendingPool ownership. ~$50M drained from Arbitrum and BSC.
- Event date
- Incident typeProtocol admin compromise
- Bug classSocial engineering
- Published
Loss, as sourced
Approximately $50 million USD from core markets on Arbitrum and BSC, per Radiant. Attackers also used open approvals against users.
Traceability
Primary sources
In brief
Root cause: Per Radiant: malware on at least three hardware-wallet signers made Safe show legitimate emissions/cap updates while malicious transferOwnership payloads were signed. Tenderly and Safe UI reviews showed no anomalies.
Timeline, as sourced: Per Radiant: malicious contracts deployed 2 Oct; 16 Oct 15:46 ARB nonce 230 proposed; 17:09 ownership transferred on Arbitrum; BSC ownership at 17:11; war room from 17:12.
Account, as sourced
Claimed (Radiant) (post-mortem (opens in a new tab)): ~$50M; users told to revoke approvals on Arb, BSC, Ethereum, Base. Admin thresholds were 3-of-N.
Unknown: initial device compromise vector.
Summaries of public sources as of the published date; except where marked (on-chain), not independently verified by NullMeridian. Figures are the sources’ own and are attributed; where sources disagree, each is given. Sources may since have changed. Not legal, financial or investment advice.
Permalinkhttps://andromeda.observer/e/radiant-safe-malware-ownership-2024