區塊鏈借貸協議 Radiant Capital 今年第二次被利用損失 5,000 萬美元

攻擊者似乎已經獲得了升級協定所需的 11 個私鑰中的 3 個。

Web3 lending protocol Radiant Capital lost over $50 million on Wednesday in an apparent cyberattack, according to security firms and blockchain data.

根據安全公司和區塊鏈數據，Web3 借貸協議 Radiant Capital 週三在一次明顯的網路攻擊中損失了超過 5,000 萬美元。

An attacker gained control of Radiant's blockchain contracts by obtaining three of the "private keys" that control the protocol, security experts said.

安全專家表示，攻擊者透過取得控制協議的三個「私鑰」來控制 Radiant 的區塊鏈合約。

CoinDesk Live at Avalanche Summit 2024 Day 1 | Partner Content

CoinDesk 於 2024 年雪崩高峰會第一天現場直播 |合作夥伴內容

"Radiant Capital contracts were exploited on BSC & ARB chains with the 'transferFrom' function," Web3 security firm De.Fi explained on X. The exploit allowed attackers to "drain users' funds, namely $USDC $WBNB $ETH and others," the firm said.

Web3 安全公司De.Fi 在X 上解釋：「Radiant Capital 合約在BSC 和ARB 鏈上透過'transferFrom'功能被利用。」該漏洞允許攻擊者「耗盡用戶的資金，即$USDC、$WBNB、 $ETH 等」。 “該公司表示。

Radiant is controlled by a multi-signature, or "multisig" wallet with 11 signers, De.Fi said in a separate X post. The attacker was apparently able to obtain three of these signers' "private keys," which was enough to upgrade the platform's smart contracts.

De.Fi 在另一篇 X 貼文中表示，Radiant 由 11 個簽署者的多重簽名或「多重簽名」錢包控制。攻擊者顯然能夠獲得其中三個簽署者的“私鑰”，這足以升級平台的智能合約。

Radiant allows users to borrow, lend and bridge cryptocurrencies across blockchains. It's the second time this year that the protocol has been hit by an exploit; in January, Radiant lost $4.5 million in an unrelated hack that stemmed from a bug in its smart contracts.

Radiant 讓用戶在區塊鏈上借入、借出和橋接加密貨幣。這是該協議今年第二次遭受漏洞攻擊。今年 1 月，Radiant 在一次無關的駭客攻擊中損失了 450 萬美元，這項駭客攻擊源自於其智慧合約中的一個錯誤。

It was unclear at press time how the private keys were compromised in Wednesday's attack. Some members of an Ethereum security group on Telegram speculated that the attack could've stemmed from a compromised front-end – meaning the legitimate Radiant key-holders may have accidentally interacted with a malware-laced protocol.

截至發稿時，尚不清楚私鑰是如何在周三的攻擊中洩露的。 Telegram 上以太坊安全小組的一些成員推測，這次攻擊可能源於受損的前端，這意味著合法的 Radiant 金鑰持有者可能意外地與帶有惡意軟體的協定進行了交互。

Radiant acknowledged the exploit in a post to its official X account, but it did not provide specific details.

Radiant 在其官方 X 帳戶的貼文中承認了該漏洞，但沒有提供具體細節。

"We are aware of an issue with the Radiant Lending markets on Binance Chain and Arbitrum," Radiant said. "We are working with SEAL911, Hypernative, ZeroShadow & Chainalysis and will provide an update as soon as possible. Markets on Base and Mainnet are paused until further notice."

Radiant 表示：“我們意識到幣安鍊和 Arbitrum 上的 Radiant 借貸市場存在問題。” “我們正在與 SEAL911、Hypernative、ZeroShadow 和 Chainaanalysis 合作，並將盡快提供更新。Base 和主網上的市場已暫停，直至另行通知。”

Radiant, which is governed by a decentralized autonomous community (DAO), states on its website that its mission is to "unify the billions in fragmented liquidity across Web3 money markets under one safe, user-friendly, capital-efficient omnichain" protocol.

Radiant 由去中心化自治社區(DAO) 管理，在其網站上表示，其使命是“將Web3 貨幣市場上數十億分散的流動性統一到一個安全、用戶友好、資本高效的全鏈協議下” 。

This is a developing story. Radiant Capital did not immediately respond to a request for comment.

這是一個發展的故事。 Radiant Capital沒有立即回應置評請求。

UPDATE (20:45 UTC, 16/10/24): Adds background information regarding Radiant and another hack in January, 2024.

更新（世界標準時間 20:45，24 年 10 月 16 日）：新增有關 Radiant 和 2024 年 1 月另一次駭客攻擊的背景資訊。

Edited by Bradley Keoun.

布拉德利·科恩編輯。

Sign up for The Protocol, our weekly newsletter exploring the tech behind crypto one block at a time.

訂閱《協議》，這是我們的每週通訊，一次探索一個區塊背後的加密技術。

By clicking ‘Sign Up’, you agree to receive newsletter from CoinDesk as well as other partner offers and accept our terms of services and privacy policy.

點擊“註冊”，即表示您同意接收來自 CoinDesk 的新聞通訊以及其他合作夥伴優惠，並接受我們的服務條款和隱私權政策。

Disclosure

揭露

Please note that our privacy policy, terms of use, cookies, and do not sell my personal information have been updated.CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. CoinDesk has adopted a set of principles aimed at ensuring the integrity, editorial independence and freedom from bias of its publications. CoinDesk is part of the Bullish group, which owns and invests in digital asset businesses and digital assets. CoinDesk employees, including journalists, may receive Bullish group equity-based compensation. Bullish was incubated by technology investor Block.one.

請注意，我們的隱私權政策、使用條款、cookies 以及不出售我的個人資訊已更新。其記者遵守一套嚴格的編輯政策。 CoinDesk 採用了一系列旨在確保其出版物的完整性、編輯獨立性和無偏見的原則。 CoinDesk 是 Bullish 集團的一部分，該集團擁有並投資數位資產業務和數位資產。 CoinDesk 員工，包括記者，可能會獲得 Bullish 集團基於股權的薪酬。 Bullish 由科技投資者 Block.one 孵化。

Sam is CoinDesk's deputy managing editor for tech and protocols. He reports on decentralized technology, infrastructure and governance. He owns ETH and BTC.

Sam 是 CoinDesk 負責技術和協議的副總編輯。他報告了去中心化技術、基礎設施和治理。他擁有 ETH 和 BTC。