Radix Foundation Fixes Vault Authorization Vulnerability, Cross-Chain Asset Withdrawal Incident Resolved

The Radix Foundation has released a report on the attack incident that occurred on August 31, where an attacker exploited a vault authorization vulnerability in the Radix Engine to withdraw assets from a third-party vault without the owner's consent, and transferred them to an external chain for sale via the Hyperlane cross-chain bridge. The vulnerability originated from a code cleanup in June 2023, and an independent security audit conducted by Zellic in August 2024 did not identify the issue. The stolen assets included ETH, WBTC, USDT, USDC, BNB, SOL, and a small amount of transaction fees in XRD, affecting ecosystem contracts and liquidity pool vaults. Following the incident, the team initiated emergency operations, Hyperlane suspended operations related to Radix, and validators voluntarily took offline sufficient staked shares to interrupt network activity and prevent further exploitation of the vulnerability. The foundation has completed the vulnerability fix, which has undergone independent review and testing, and is now advancing network recovery.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.