Three-year-old Radix bug drains $1.3M, halts chain 10 days

A flaw introduced during a 2023 code refactor of the Radix Engine let an attacker withdraw roughly $1.3 million in tokens on Aug. 31 and prompted validators to stop transaction finalization while developers fixed the execution layer.

Community ledger reconstructions show the attacker executed 26 exploit transactions between 16:02 and 16:57 UTC on Aug. 31. The withdrawals included about 458,915 USDC, 72,420 USDT, 61.08 ETH, 6.35 wrapped Bitcoin, 536.16 SOL and 32.91 BNB, plus roughly 13,000 XRD used for fees. Using Aug. 31 market prices, those assets totaled about $1.26 million.

Investigators traced the defect to a change in how the engine handled internal vault references. A transaction could pass a vault address belonging to another user or application into smart-contract code, and ordinary withdrawal functions then ran without enforcing ownership checks. The flaw allowed movement of assets from user accounts, applications and liquidity pools without owners’ signatures. No private keys were compromised.

After taking assets on Radix, the attacker used the Hyperlane cross-chain messaging protocol to move funds to Ethereum, BNB Chain and Solana and then exchanged those holdings for ETH, according to Radix. The bridge itself operated as designed; the attacker had already obtained the assets through the engine flaw before sending them off-chain.

The removal of bridged assets skewed prices in affected liquidity pools. Those price shifts made it possible for a separate account to extract millions of XRD from some pools, producing additional losses beyond the initial theft.

Once investigators determined the vulnerability lay in the execution layer rather than a single application, validators coordinated to take enough stake offline to prevent consensus and stop transaction finalization. The halt lasted more than 10 days. A protocol update added checks to prevent restricted vault references from being used with ordinary withdrawal functions, and community transaction processing resumed on Sept. 11, according to ledger records.

The defect survived an independent security review in 2024 that included the engine kernel where the flaw resided. Radix traced the original code change to routine maintenance by an RDX Works development team in June 2023.

Radix plans to add regression tests, strengthen security review processes and formalize the emergency procedure validators used to break network liveness. The Foundation also said future security work will consider AI-assisted code analysis tools that may make old defects easier to find.