On October 16, 2024, Radiant Capital, a decentralized lending protocol, suffered a major security breach, resulting in a $50 million loss.
A detailed report has since connected the attack to North Korean hackers, specifically the group UNC4736, which has ties to the country’s intelligence agency. The breach began with a carefully planned phishing scam in September, when a developer was tricked into downloading a malicious file disguised as a contract audit report.
After the malware was activated, the attackers were able to infiltrate Radiant’s internal systems. They then orchestrated a man-in-the-middle (MITM) attack, manipulating transaction data to seize control of the platform’s lending pools.
Despite the platform’s security measures, such as hardware wallets and transaction checks, the hackers succeeded in bypassing these defenses.
The hack has sent shockwaves through the DeFi industry, underscoring the vulnerabilities even sophisticated platforms face. In the aftermath, Radiant has engaged cybersecurity experts to track down the stolen funds and work with law enforcement.
The attack has also raised awareness about gaps in DeFi security, particularly with phishing schemes and transaction validation processes, prompting Radiant to advocate for stronger security protocols across the industry.
The U.S. Securities and Exchange Commission (SEC) has filed emergency enforcement actions against First Liberty Building & Loan, LLC and its founder, Edwin Brant Frost IV, alleging they operated a $140 million Ponzi scheme that spanned more than a decade and defrauded around 300 investors.
A legal clash between Coin Center and the U.S. Treasury Department over sanctions imposed on Tornado Cash has officially come to an end, following a joint decision to dismiss the case.
A sophisticated cyberattack targeting Brazil’s central bank reserve accounts has resulted in the theft of over $140 million (R$800 million), much of which was swiftly funneled through cryptocurrency channels.
A malicious open-source project on GitHub disguised as a Solana trading bot has compromised user wallets, according to a July 2, 2025, report by cybersecurity firm SlowMist.