A defect in the Radix Engine, the software layer that executes transactions and enforces asset ownership across the Radix network, enabled an attacker to drain roughly $1.3 million in digital assets on August 31. The vulnerability was introduced by an RDX Works development team during a June 2023 code refactor and remained undetected for more than three years.
According to a community reconstruction of the ledger, the attacker withdrew approximately 458,915 USDC, 72,420 USDT, 61.08 ETH, 6.35 wrapped Bitcoin, 536.16 SOL, and 32.91 BNB across 26 transactions completed between 16:02 and 16:57 UTC on August 31. Using market prices from that date, the stolen assets were valued at roughly $1.26 million, with stablecoins accounting for approximately $531,335. The attacker also took 13,000 XRD tokens to cover transaction fees.
The stolen assets were transferred through the Hyperlane bridge to Ethereum, BNB Chain, and Solana, then sold for ETH, Radix said. The bridge itself operated as designed, as the attacker had already obtained the assets through the Radix Engine before moving them to other networks. No private keys were compromised.
Vulnerability Bypassed Authorization Checks
The bug altered how the Radix Engine handled vault references, a critical security function. A transaction could identify another user's vault by its internal address and pass that reference to smart-contract code. The engine then allowed ordinary withdrawal functions to execute without properly enforcing ownership boundaries, giving the attacker access to assets held by user accounts, applications, and liquidity pools without requiring owner signatures.
The vulnerability's scope extended beyond the attacked accounts. Radix investigators determined the flaw could have been used against any vault on the network, potentially exposing all bridged and non-bridged assets.
Security Audit Failed to Detect Defect
The vulnerability had already survived an independent security review. Zellic audited the Radix protocol in 2024, including the engine kernel containing the defect. The review did not detect the authorization flaw, despite the vulnerable code being introduced during the previous year's refactor.
Validators Halt Network to Prevent Further Damage
Once investigators determined the vulnerability existed in the execution layer rather than a single application, network validators coordinated to stop transaction finalization. The deliberate halt lasted more than 10 days while developers worked on a fix. A protocol update added checks preventing restricted vault references from being used for ordinary withdrawals, and transactions resumed on September 11.
Secondary Losses Compound Initial Damage
After the attacker removed bridged assets from one side of trading pairs, distorted prices allowed another account to extract millions of XRD from affected liquidity pools, demonstrating how execution-layer failures can cause ongoing economic damage beyond the initial theft.
Response and Future Security Measures
The Radix Foundation said it is adding regression tests, strengthening its security review process, and formalizing the emergency procedure validators used to restore network liveness. The Foundation also noted that future security work must account for increasingly capable AI-assisted code-analysis tools.
