Radix Blockchain Hacked for $1.3 Million Due to 3-Year-Old Bug

A 3-year-old bug in the Radix Engine allowed hackers to drain $1.3 million from user accounts, prompting a 10-day halt of the blockchain.

The vulnerability was introduced during a routine code refactor in June 2023 and remained undetected until August 31 when an attacker exploited it. The hacker withdrew various assets including USDC, USDT, ETH, wrapped Bitcoin, SOL, and BNB across 26 transactions.

Radix investigators concluded that the flaw could have been used to target any vault on the network, putting tokens and other assets at risk. In response, validators deliberately took enough stake offline to prevent further transactions while developers worked on a fix.