The exploiter behind the massive Radiant Capital hack has continued to systematically launder stolen funds, transferring approximately 5,411.8 Ether to the privacy-focused mixing protocol Tornado Cash. Valued at roughly $20.7 million at the time of the transaction on Oct. 31, 2025, the substantial movement marks another calculated step in a prolonged digital asset distribution campaign. <\/p>\n
This latest development follows a similar pattern observed just nine days prior, when the same cluster of associated addresses moved approximately 2,834.6 ETH, equivalent to $10.8 million. Before reaching the mixer, those funds were meticulously staged across multiple blockchain networks and processed through a series of decentralized exchange swaps. <\/p>\n
Neither of these recent financial bursts appeared hurried or panicked. Instead, both operations bore the hallmarks of a careful and methodical operator testing network liquidity, assessing compliance timing, and parceling deposits into standardized Tornado denominations. These specific amounts are historically inexpensive to blend within the mixing protocol and notoriously difficult for blockchain investigators to trace efficiently.<\/p>\n
The origins of the current laundering campaign trace back to Oct. 16, 2024, when Radiant Capital\u2019s lending pools operating across the Arbitrum and BNB Chain networks were drained of an estimated $50 million to $58 million. Early technical post-mortem analyses conducted by various cybersecurity firms quickly converged on a simple yet devastating vector: an operational security compromise involving keyholders and transaction approvals. <\/p>\n
The breach was executed by manipulating trusted parties into pushing malicious transactions through a multi-signature governance process. Security researchers subsequently described scenarios where authorized signers were induced to approve fraudulent calls. At the time of the incident, the project utilized a three-out-of-eleven threshold scheme for sensitive administrative and operational actions. While this broad set of keyholders improved system availability and decentralization, it inadvertently widened the attack surface, increasing vulnerability to device compromise and sophisticated social engineering tactics.<\/p>\n
Detailed forensic analyses from security firms such as Halborn reconstructed how specific approvals and lax device hygiene created narrow execution windows that the attacker successfully exploited. Radiant\u2019s own incident update reports later helped clarify the timeline and overall scale of the breach. Subsequent reporting indicated that a sophisticated, state-backed threat actor may have utilized targeted impersonation techniques to gain unauthorized access\u2014a hypothesis that the Radiant team itself echoed as the initial dust settled.<\/p>\n
CryptoSlate closely covered the broader fallout of the incident through a financial crime trend lens at the time. A prominent monthly report highlighted that total exploit losses across the decentralized finance sector fell to approximately $116 million in October 2024. Significantly, the Radiant incident accounted for nearly half of that entire monthly figure, concentrating an outsized share of the industry’s financial pain into a single event.<\/p>\n
That contextual framing remains critical because it demonstrates how a single, highly coordinated cross-chain breach can disproportionately distort a given month\u2019s risk profile, even during periods when the broader cryptocurrency market environment appears relatively calm. <\/p>\n
Over the subsequent year, a predictable operational pattern emerged. Stolen funds were systematically moved out of Layer 2 scaling networks and funneled back to the Ethereum mainnet via cross-chain bridges where market liquidity is deepest. Decentralized exchange swaps were then utilized to consolidate fragmented balances entirely into Ether, preparing the inventory for the upcoming mixing process.<\/p>\n
The transactions observed between Oct. 22 and Oct. 23, 2025, provided a textbook example of this behavior. Blockchain security firm CertiK flagged 2,834.6 ETH moving into Tornado Cash, noting that 2,213.8 ETH of that total had arrived via the Arbitrum bridge from an externally owned account designated as EOA 0x4afb, with the remainder sourced directly from historical conversions of USD Coin and DAI.<\/p>\n
The subsequent burst on Oct. 31 increased the running cumulative total by another 5,411.8 ETH, utilizing modular deposits that precisely matched standard Tornado pool norms. Because the underlying blockchain ledger is entirely public, the transit route remains predictable. However, the underlying economic incentives strongly encourage patience over spectacle, allowing the bad actor to operate without drawing immediate, chaotic market reactions.<\/p>\n
The recent mixer activity reads much more like a slow-bleed containment strategy than a hurried exit scam. Bridge hops originating from networks like Arbitrum or BNB Chain successfully transport digital asset balances into the deepest liquidity pools on the Ethereum mainnet. Subsequent decentralized exchange rotations configure the inventory into native ETH to facilitate the most efficient entries into Tornado Cash.<\/p>\n
By batching these funds into standard denominations, the operator effectively fractures the public transaction graph into smaller, disconnected fragments that are exceptionally costly and time-consuming for analysts to stitch back together. Despite these obfuscation techniques, modern compliance and blockchain intelligence teams still retain substantial visibility. Investigators routinely cluster related addresses around shared gas usage patterns and precise timing heuristics, match specific deposits to corresponding withdrawal windows, and monitor for telltale peel chains that start with small amounts, fan out widely, and eventually re-aggregate near a target destination venue.<\/p>\n
This cat-and-mouse posture remains intensely pragmatic because the evolving legal and regulatory environment continues to reward strategic adaptation. Over recent months, federal courts have narrowed the government\u2019s broadest legal theories regarding the administrative sanctioning of decentralized software code. Prosecutors have secured victories in some legal battles while suffering notable setbacks in others concerning developer liability and the operational status of cryptocurrency mixers.<\/p>\n
The resulting landscape is a complex gray zone where privacy-preserving tools continue to function, and centralized cryptocurrency exchanges increasingly rely on behavior-driven monitoring controls rather than blanket, generalized asset labeling. While advanced forensic investigations still manage to intercept certain exits, the primary friction has fundamentally shifted from software-level blocks to operational process.<\/p>\n
For decentralized finance users and protocol builders, the overarching lesson is concrete: architectural design choices carry direct financial outcomes. Bridges and multi-chain routers inherently concentrate both immense value and critical failure modes, which explains precisely why exploiters consistently rely on them during their exit strategies. Multi-chain decentralized applications require established protocols for emergency pauses, allowlist modifications, and immediate liquidity snapshots, rather than relying on ad hoc improvisation during the chaotic hours immediately following a security breach.<\/p>\n
Radiant\u2019s published documentation illustrates how its organizational response hardened over time, though the financial costs of that steep learning curve were severe because the attacker maintained the initiative from the outset. The ongoing transaction flows currently observed moving through Tornado Cash represent the final tail of that statistical distribution. <\/p>\n
The operator continues to move funds because the underlying blockchain rails remain operational. The appropriate counter-strategy for the broader industry involves rigorous keyholder procedures, minimized smart contract approvals, real-time cross-chain bridge monitoring, and an organizational culture that treats signer hardware devices with the utmost security.<\/p>\n
The Radiant exploiter is expected to continue employing this patient playbook until market conditions or enforcement mechanisms shift. Additional Tornado deposits will likely arrive in familiar sizes, and further bridge activity may appear from addresses linked to the original October 2024 transit paths. Eventually, a cleaned batch of funds will attempt to ping a regulated trading venue, where compliance desks will carefully weigh timing heuristics against user onboarding narratives.<\/p>\n
The broader consequence for the digital asset market remains entirely predictable. Every patient, methodical exit of this nature chips away at user confidence in cross-chain abstractions, compelling development teams to audit not just their smart contract code, but their underlying operational hygiene. Retail users continuously chase yield across disparate blockchain networks because the user experience feels seamless, yet sophisticated malicious actors know precisely where the seams in those architectures are hidden.<\/p>\n","protected":false},"excerpt":{"rendered":"
The exploiter behind the massive Radiant Capital hack has continued to systematically launder stolen funds,…<\/p>\n","protected":false},"author":12,"featured_media":760,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[295],"tags":[6,752,26,753,314,365,286,757,754,527,756,244,751,5,758,755],"class_list":["post-761","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blockchain-hacks-exploits","tag-blockchain","tag-capital","tag-cash","tag-exploiters","tag-exploits","tag-hack","tag-hacks","tag-laundering","tag-millions","tag-move","tag-ongoing","tag-post","tag-radiant","tag-security","tag-strategy","tag-tornado"],"_links":{"self":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/761","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=761"}],"version-history":[{"count":0,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/761\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/media\/760"}],"wp:attachment":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=761"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=761"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=761"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}