# Radiant Capital: a document request can become a treasury incident

Canonical: https://www.web3sec.news/blog/radiant-capital-developer-opsec
Author: Raiders (https://www.web3sec.news/about)
Format: postmortem
Topic: Web3
Published: 2026-11-08
Updated: 2026-11-08
Incident date: 2024-10-16

A reported malware delivery chain connects developer communications, workstation trust and multisig operations.

## The reported path into the organization

In its 6 December 2024 incident update, Radiant described the approximately $50 million theft on 16 October. The team reported that a developer had received a Telegram message impersonating a former contractor. A ZIP archive presented as an audit-related document delivered malware while showing a plausible PDF.

Radiant said multiple developer devices were compromised and signing interfaces displayed benign information while malicious transactions were signed. Its account also describes why existing simulation and review procedures did not reveal the deception. We rely on that published account and have not examined the affected devices.

## Where a stronger boundary belongs

Our analysis: treating a familiar sender or a security-themed document as trustworthy confuses social context with file provenance. The same workstation should not serve as the unrestricted inbox, experimental code runner and final authority for treasury operations.

Create a separate environment for external repositories and document archives. Verify unusual requests over a previously established channel. Dedicated signing environments should have a small application set, restricted browser extensions and no routine installation of code supplied through chat.

## Detection and recovery need to meet

Map endpoint detections to treasury decisions. A suspicious persistence mechanism on a signer device should trigger a pre-agreed signing pause and an assessment of session tokens, wallet permissions and pending proposals. Reinstalling a laptop alone does not invalidate credentials or revoke on-chain authority.

During a tabletop exercise, ask who can pause the protocol, who preserves device evidence and how the team communicates if its normal chat environment is suspect. Keep recovery signers and contact details outside the everyday environment.

## Controls to take away

- Verify unexpected requests through a separate channel.
- Separate external document handling from treasury signing.
- Connect endpoint compromise response to wallet authority review.

## Sources & further reading

- [Radiant Capital: incident update, 6 December 2024](https://medium.com/@RadiantCapital/radiant-capital-incident-update-e56d8c23829e)

Incident facts are attributed to the linked reports. Recommendations are Web3Sec's analysis.

[Research methodology](https://www.web3sec.news/methodology) · [Editorial policy](https://www.web3sec.news/editorial-policy) · [Send a correction](https://www.web3sec.news/contact)