On 16 October 2024 attackers compromised three Radiant core contributors' devices with the INLETDRIFT macOS backdoor (delivered via Telegram impersonation of a former contractor) and manipulated the Safe{Wallet} front-end so signers saw legitimate data while signing malicious transactions, taking ownership of and draining Radiant lending markets on BSC and Arbitrum. Mandiant attributed the attack to DPRK-nexus actors.