North Korean hackers, known as UNC4736 or Citrine Sleet, stole $50 million from Radiant Capital, a DeFi platform, in a sophisticated cyberattack. The breach began on September 11 when malware was delivered to a Radiant developer via a fake Telegram message from a trusted source. The malware spread to other developers, granting the attackers access to private keys and allowing them to manipulate smart contracts.

The hackers drained cryptocurrencies, including USDC, ETH, and BNB, converting them into Ethereum and Binance Coin. Radiant halted its operations after detecting the breach on October 16. Despite using advanced security tools, the attack exploited gaps in verification processes, exposing vulnerabilities in DeFi platforms. The incident highlights ongoing risks posed by North Korean state-backed cyber groups, which have stolen over $3 billion in cryptocurrency for government programs since 2017