Radix Foundation Reports Exploit of Unseen Radix Engine Vulnerability

Radix Foundation said an attacker used an undiscovered vulnerability in Radix Engine to withdraw assets from third-party vaults without owner authorization, then bridged them through Hyperlane to networks including Ethereum, BNB Chain, and Solana before selling them. According to Odaily, the flaw originated from a code cleanup in June 2023, and an independent security audit by Zellic in August 2024 did not detect it. About three hours after the incident, Radix validators took enough stake offline to prevent the network from reaching consensus and stop further exploitation. The affected assets included ETH, WBTC, USDT, USDC, BNB, and SOL. Radix said the fix has been completed and independently reviewed and tested, and network recovery is now underway.