North Korea Killed Radiant Capital: How the Lazarus Group Turned a $386M DeFi Protocol Into a $2M Husk

Radiant Capital is shutting down. On June 1, 2026, the protocol’s DAO announced an orderly wind-down of operations after 18 months of failed recovery efforts following its devastating October 2024 exploit. The reason is simple and brutal: no funds were recovered, no new capital arrived, and without either, the protocol could not remain sustainable. The cross-chain lending platform that once held $386.8 million in total value locked now sits at $2.21 million. Its RDNT token, which peaked at $0.58 in September 2022, trades at $0.0015. Its market cap is $1.96 million, ranked #2356 globally.

The October 2024 attack was not a smart contract bug or a flash loan exploit. It was a nation-state operation. Cybersecurity firm Mandiant attributed the hack to AppleJeus, a campaign run by North Korea’s Lazarus Group, the same state-sponsored hacking unit responsible for hundreds of millions of dollars in crypto theft globally. The attackers spent weeks building trust, delivered malware through a Telegram message disguised as a legitimate contractor request, compromised developer hardware wallets, and used that access during a multisig signing process to seize control of the protocol’s Pool Provider contract. By the time anyone noticed, $50 million was gone.

How North Korea Took Down a $386M Protocol

The attack began not with code but with a conversation. Five weeks before the October 16, 2024 exploit, an individual posing as a former Radiant contractor reached out to contributors on Telegram with what appeared to be a legitimate request for feedback. The message included a malicious ZIP file. When a developer opened it, INLETDRIFT, a macOS-targeting backdoor, silently installed itself on their hardware. Then it waited.

On October 16, during a routine multisig transaction signing process where multiple developers authorize protocol changes together, the malware activated. It manipulated what each developer saw on their hardware wallet screen, showing legitimate transaction data while the actual transaction being signed was something entirely different. The attackers had seized control of Radiant’s Pool Provider contract. The $50 million drain followed immediately, hitting the protocol’s Arbitrum and BNB Chain deployments. By the time the team understood what had happened, the funds were already moving through mixers.

Mandiant’s subsequent investigation attributed the attack to AppleJeus, a campaign run under North Korea’s Lazarus Group. The same tactics, building trust through fake professional contacts at conferences, deploying malware through seemingly legitimate documents, then using that access during signing ceremonies, later surfaced in an April 2026 attack on Drift Protocol. The Lazarus Group’s crypto theft operations are not opportunistic. They are systematic, patient, and replicated across multiple targets.

The TVL Collapse: $386M to $2.21M in 18 Months

Radiant’s TVL did not fall gradually after the exploit. It collapsed in stages that each tell a specific story about user trust, exchange support, and institutional confidence. The protocol held $386.8 million in December 2023, making it one of the larger cross-chain lending platforms in DeFi. The January 2024 flash loan attack, which drained around 1,900 ETH, was the first crack. The DAO absorbed it using treasury reserves, but those reserves were the buffer that would later prove insufficient.

The October 2024 exploit, 13 times larger than the first, was unsurvivable. TVL dropped from around $75 million immediately after the attack to approximately $5 million within a month as users rushed for the exits. Every exchange delisting that followed, OKX in January 2025, Crypto.com in July 2025, Binance halting spot trading in April 2026, was another stage of the collapse. When Binance ended withdrawal support for RDNT on June 1, the same day as the wind-down announcement, it eliminated the last major centralized exchange venue. Residual RDNT balances on Binance are being converted to stablecoins automatically.

What Happens to Users Now

Radiant is emphatic that this is an orderly wind-down, not a collapse. Smart contracts remain accessible on-chain. Users retain full control of their assets and positions. Withdrawals, loan repayments, collateral management, vesting rewards, and DLP unlock and withdrawal are all still available. The protocol’s website and front-end will remain live through the end of 2026. The DAO has reduced borrow caps to zero across all Core and RIZv1 markets, meaning no new loans can be opened, but existing positions can be managed and closed.

Compensation through on-chain claim contracts remains active for users affected by the exploit. Recovery efforts have not stopped. The DAO is still working with zeroShadow on forensic tracking and asset tracing, though 18 months of work has produced no recovered funds. A small group of contributors will remain to manage user support, maintain claims infrastructure, and coordinate with recovery partners. RDNT token emissions have ended, and treasury spending is now restricted to these essential functions.

Users who lost funds in the exploit have made their frustration visible. In response to the wind-down announcement on X, user Ivan Mocharnyk asked directly: “What about my $6,000 I lost in the hack?” Others questioned whether compensation claims would remain valid as the protocol entered maintenance mode. The DAO’s answer is that claim contracts remain active on-chain indefinitely. Whether the funds those contracts represent ever materialize depends entirely on whether any of the $50 million stolen by the Lazarus Group is ever traced and recovered, which currently looks unlikely.

The DeFi Pattern Nobody Wants to Talk About

Radiant is not unique. The trajectory from exploit to wind-down follows a pattern that has now repeated across multiple DeFi protocols. Uranium Finance never regained liquidity after losing $57 million in a 2021 flash loan attack and faded into inactivity. Step Finance shut down in 2026 after a $27 to $40 million treasury drain. In each case, the technical recovery from an exploit, patching the code, understanding what happened, improving governance, happened relatively quickly. The economic recovery, restoring user confidence, rebuilding TVL, attracting new capital, never did.

The Radiant case adds a dimension that makes it more instructive than most. This was not a code vulnerability. There was no bug in the smart contracts. The attackers defeated the human layer: the developers themselves. Social engineering, hardware wallet manipulation, fake professional relationships cultivated over months, these are not threats that a security audit addresses. They are threats that require operational security protocols for every team member handling protocol governance, including hardware wallet verification procedures that make multisig manipulation detectable even when the signer’s screen has been compromised.

The fact that the same attack pattern resurfaced at Drift Protocol in April 2026, with investigators concluding the same actors built trust through conferences and professional contacts before deploying tools, means this is not a solved problem. The Lazarus Group is iterating faster than the defensive playbooks being written in response.

The Lazarus Group: $6 Billion in Crypto Theft and Counting

Radiant Capital is one entry on a long and growing list. North Korea’s Lazarus Group, also known as APT38 and BlueNorOff, is a state-sponsored hacking collective under the Reconnaissance General Bureau. Chainalysis estimates cumulative DPRK-linked crypto theft exceeds $6 to $6.75 billion. The stolen funds are widely believed to fund North Korea’s weapons and nuclear programs, making crypto theft a national revenue source, not a criminal side operation. In 2025 alone, North Korean actors stole more than $2 billion. The February 2025 Bybit hack, a $1.5 billion supply-chain attack on Safe’s multisig interface, is the largest single crypto theft in history.

The tactical evolution is what makes the Lazarus Group uniquely dangerous. Early attacks relied on basic phishing. By 2022 the group had graduated to validator social engineering, compromising the Ronin bridge through fake job offers. By 2024 and 2025, the operations became long-form infiltrations: months of building real professional relationships with target employees, attending crypto conferences in person, depositing large sums to establish credibility, then deploying malware through what appeared to be legitimate documents. The Radiant attack compressed this to a Telegram message. The Drift Protocol attack in April 2026 involved in-person conference meetings sustained over months before the exploit executed.

The recovery rate across all of these incidents is close to zero. The Ronin hack produced some law enforcement action but minimal asset recovery. Harmony’s $100 million is largely unrecovered. The Lazarus Group routes stolen funds through mixers, cross-chain bridges including THORChain, and privacy tools before cashing out through intermediaries. The speed and sophistication of the laundering, often beginning within hours of the exploit, makes tracing increasingly difficult. zeroShadow’s 18 months of forensic work on the Radiant case, alongside Mandiant, U.S. law enforcement, and Hypernative, produced no meaningful recovery. That outcome is not exceptional. It is the norm for Lazarus Group attacks.

This article is for informational purposes only. Sources: Radiant DAO Medium post, @RDNTCapital on X, AMBCrypto, The Block, The Defiant, BeInCrypto, Crypto.news, CryptoTimes, Mandiant, DeFiLlama. Published June 4, 2026.

Arun

Aaron | Senior Cybersecurity & Blockchain Strategist. Aaron is a cybersecurity professional with over 20 years of experience leading security operations for global institutions. A frequent speaker at international Cybersecurity and Blockchain conferences, he has been a lead contributor at CryptoNewsBytes since 2017. ✍️ By combining two decades of security leadership with deep-dive reporting on AI, emerging threats, and crypto regulations (including the CLARITY and GENIUS Acts), Aaron provides institutional-grade clarity for the evolving 2026 digital asset landscape. 🛡️🌐

See Full Bio

Blockchain Crypto Regulation Bitcoin Blockchain Patents Cryptocurrency Digital Assets Non-Fungible Token Smart Contract Cybersecurity Cryptocurrency Exchange Altcoins

Subscribe To Our Newsletter

Join our mailing list to receive the latest news and updates from our team.

SUBSCRIBE!

You have Successfully Subscribed!