Radiant capital hacker flips looted $53M for 94% profit, here’s how they did it

The attacker responsible for last year’s Radiant Capital hack recently made an interesting play, turning the stolen funds into nearly double their original value.

In an August 14 X post, blockchain intelligence platform Lookonchain highlighted that the exploiter has grown their $53 million haul into approximately $102.5 million, booking a 93.5% profit through patient holding and times sales of Ethereum (ETH).

Following the exploit in October 2024, the hacker converted all stolen assets into a total of 21,957 ETH. After several months of silence, the exploiter recently resurfaced on August 12 amid ETH’s climb to take profit, exchanging 9,631 ETH for $43.9 million USD-pegged DAI (DAI) stablecoin at an average price of $4,562.

The stablecoins were moved into a separate wallet, and the transaction left their ETH stash holding approximately 12,326 ETH. Over the past few days, Ethereum has climbed significantly to new highs, trading slightly under $4,750 at the time of writing. This has lifted the remaining holdings to a valuation of about $58.6 million, up 3% on the day.

Holding ETH for nearly ten months allowed the exploiter to add about $49.5 million to their original haul. Instead of an immediate liquidation, the attacker methodically unloaded the assets, suggesting a long-term cash-out strategy.

The Radiant capital hack was one of the most devastating industry losses of 2024. All efforts to recover the stolen funds have proven futile, and the latest shuffles by the attackers suggest that the funds may be lost for good.

The Radiant capital hack

Last October, attackers used social engineering to impersonate a former Radiant Capital contractor via Telegram, delivering a zip file disguised as a PDF to the protocol. The file contained macOS malware that altered transaction displays, tricking developers into signing malicious smart contract calls.

Blockchain security experts tied the attack to the North Korea-linked group AppleJeus, another hacking syndicate that preys on the industry alongside the notorious Lazarus.

By exploiting routine transaction resubmissions, the attackers gathered enough compromised signatures to transfer ownership of Radiant’s lending pools on Arbitrum and Binance Smart Chain, resulting in hefty losses.

The incident remains a reminder of the disturbing trend of cyberattacks that continues to plague the broader industry. So far this year, over $3.1 billion has been lost to various forms of scams and hacks. Hackers continue to sharpen their tactics to match evolving security standards, underscoring the need for stronger industry-wide defense.