North Korean Hackers Exploit DeFi Platform Radiant Capital in Sophisticated Heist  

• North Korean hackers infiltrated Radiant Capital through a Telegram-based phishing attack.  
• Malicious contracts were deployed across Ethereum and Binance Smart Chain networks.  
• Radiant Capital collaborates with law enforcement to recover stolen funds and improve security.   

Radiant Capital has become the latest victim in several cyberattacks targeting decentralized finance platforms. Cybersecurity experts have traced the breach to a group linked to North Korea’s intelligence division. The attack, which began in September 2024, highlights the increasing sophistication of state-sponsored cybercrime in crypto.  

The hackers reportedly initiated the breach by targeting a developer at Radiant Capital through a Telegram message.

The message, appearing to come from a former contractor, included a file purportedly showcasing smart contract audit work. However, the file contained malware disguised as a PDF, enabling the attackers to access the developer’s device and infiltrate the platform’s systems.  

Using the compromised access, the hackers deployed malicious smart contracts on multiple blockchain networks, including Ethereum and Binance Smart Chain.

Over several weeks, the attackers exploited vulnerabilities in transaction data manipulation to avoid detection. Despite implementing standard security protocols, Radiant Capital could not identify the breach until the funds had been stolen.  

The stolen assets were moved swiftly, with the attackers leaving minimal traces of their methods. Reports suggest the hackers erased evidence of the malware and other tools used in the operation.

This incident underscores the persistent risks faced by DeFi platforms, particularly regarding transaction verification systems that skilled adversaries can exploit.  

Radiant Capital is now working with cybersecurity firms, law enforcement agencies, and blockchain analysis companies to trace the stolen funds. The platform aims to strengthen its security measures and prevent further breaches. This attack is a stark reminder of the growing threat of advanced cyberattacks in the decentralized finance sector.