區塊鏈借貸協議 Radiant Capital 今年因第二次區塊鏈漏洞損失 5,000 萬美元

攻擊者似乎已經獲得了升級協定所需的 11 個私鑰中的 3 個。

Web3 lending protocol Radiant Capital lost over $50 million on Wednesday in a blockchain exploit, according to security experts and blockchain data.

根據安全專家和區塊鏈數據，Web3 借貸協議 Radiant Capital 週三因區塊鏈漏洞損失超過 5,000 萬美元。

An attacker gained control of Radiant's blockchain contracts by obtaining three of the "private keys" that control the protocol, security experts said.

安全專家表示，攻擊者透過取得控制協議的三個「私鑰」來控制 Radiant 的區塊鏈合約。

"Radiant Capital contracts were exploited on BSC & ARB chains with the 'transferFrom' function," Web3 security firm De.Fi explained on X. The exploit allowed attackers to "drain users' funds, namely $USDC $WBNB $ETH and others," the firm said.

Web3 安全公司De.Fi 在X 上解釋：「Radiant Capital 合約在BSC 和ARB 鏈上透過'transferFrom'功能被利用。」該漏洞允許攻擊者「耗盡用戶的資金，即$USDC、$WBNB、 $ETH 等」。 “該公司表示。

Radiant is controlled by a multi-signature, or "multisig" wallet with 11 signers, De.Fi said in a separate X post. The attacker was apparently able to obtain three of these signers' "private keys," which was enough to upgrade the platform's smart contracts.

De.Fi 在另一篇 X 貼文中表示，Radiant 由 11 個簽署者的多重簽名或「多重簽名」錢包控制。攻擊者顯然能夠獲得其中三個簽署者的“私鑰”，這足以升級平台的智能合約。

The Radiant platform encompasses a suite of tools allowing users to borrow, lend, and bridge cryptocurrencies across blockchains.

Radiant 平台包含一套工具，讓用戶在區塊鏈上借入、借出和橋接加密貨幣。

It's the second time this year that the protocol has been targeted in an exploit: In January, Radiant lost $4.5 million in an unrelated hack stemming from a bug in its smart contracts.

這是該協議今年第二次成為攻擊目標：1 月份，Radiant 在一次因智慧合約漏洞而引發的不相關駭客攻擊中損失了 450 萬美元。

It was unclear at press time how the private keys were sabotaged in Wednesday's attack. Some members of an Ethereum security group on Telegram, the messaging app, speculated that the attack could've stemmed from a compromised front-end – meaning the legitimate Radiant key-holders may have accidentally interacted with a malware-laced protocol.

截至發稿時，尚不清楚週三的攻擊中私鑰是如何被破壞的。訊息應用程式Telegram 上的以太坊安全小組的一些成員推測，這次攻擊可能源於受損的前端，這意味著合法的Radiant 金鑰持有者可能意外地與帶有惡意軟體的協議進行了交互。

Radiant acknowledged the exploit in a post to its official X account, but it did not provide specific details.

Radiant 在其官方 X 帳戶的貼文中承認了該漏洞，但沒有提供具體細節。

"We are aware of an issue with the Radiant Lending markets on Binance Chain and Arbitrum," Radiant said. "We are working with SEAL911, Hypernative, ZeroShadow & Chainalysis and will provide an update as soon surprising as possible. Markets on Base and Mainnet are paused until further notice."

Radiant 表示：“我們意識到幣安鍊和 Arbitrum 上的 Radiant 借貸市場存在問題。” “我們正在與 SEAL911、Hypernative、ZeroShadow 和 Chainaanalysis 合作，並將盡快提供令人驚訝的更新。Base 和主網上的市場已暫停，直至另行通知。”

Radiant, which is controlled by a decentralized autonomous community, or DAO, states on its website that its mission is to "unify the billions in fragmented liquidity across Web3 money markets under one safe, user-friendly, capital-efficient omnichain."

Radiant 由去中心化自治社區 (DAO) 控制，在其網站上表示，其使命是「將 Web3 貨幣市場上數十億分散的流動性統一到一個安全、用戶友好、資本高效的全鏈下」。

This is a developing story. Radiant did not immediately respond to a request for comment.

這是一個發展的故事。 Radiant 沒有立即回應置評請求。