On June 1, 2026, Radiant Capital DAO officially announced it would cease active development and enter orderly liquidation. For DeFi watchers the announcement was no surprise: after the major incident of October 2024, Radiant had worked through 18 months of governance restructuring and security upgrades — and still could not recover.
1. How did the attacker gain protocol control? (What to do when key compromise blocks assets)
Delta & Capital's forensic tracing shows Radiant's attack differed fundamentally from classic DeFi contract exploits. Past incidents mostly hit the contracts themselves (flash-loan manipulation, reentrancy, oracle bugs); Radiant's breach sat lower, in the security governance of the protocol's multi-sig operations environment.
Per the team's technical report, the attacker first compromised the endpoints of core multi-sig developers and injected a malicious front-end into the Safe Wallet interface. Signers saw perfectly normal transaction requests and parameters on screen — while the payload Safe actually broadcast to the chain had been swapped.
Delta & Capital's warning to high-net-worth users and institutions worldwide: no number of contract audits helps if off-chain management endpoints fall and anti-poisoning physical isolation is missing — the multi-sig trust chain collapses in an instant. So what do you do when a key compromise blocks your assets? Build an active defense across endpoint protection, cold-warm multi-sig, and emergency circuit-breakers — and prepare compliant on-chain forensic materials to prove ownership.
2. Why were RIZ Vault users hit too? (How to lift wallet address restrictions)
After the incident, ordinary users who never touched liquidity mining and merely parked assets in the RIZ Vault aggregator asked: my funds sat in the underlying custody pool — why did I take the same loss?
The answer lies in DeFi's capital-efficiency-maximization design. RIZ Vault is not a static multi-sig safe; it runs on automated yield-strategy contracts that dynamically re-deploy user assets across Arbitrum and BNB Chain markets based on slippage and utilization.
When the underlying market collapses and users face address restrictions or passively locked funds, how do you lift the restrictions and pull back exposure? Start with full tracing and forensic audit of the strategy flows, separate contaminated strategy assets from clean ones, and submit a structured source-of-funds proof (SOW) to governance to secure priority claims when the vault liquidates and funds flow back.
3. Eighteen months of recovery could not save the project (risk-controlled by Binance/OKX — what now?)
After the $50M blow, the team and DAO truly poured resources into self-rescue: a reorganized governance council, multi-day timelocks, an emergency-admin framework, and a compensation-appeal portal for stolen funds. But for any network-effect protocol that lives on TVL and credit expansion, purely technical repair is not enough.
Without decisive capital injection or large-scale recovery of the stolen funds, revenue collapsed and liquidity suffered a devastating retreat — a vicious cycle of bad-debt accumulation → capital flight → inverted yields → operational stall, forcing the endgame. The recovery logic mirrors retail users blocked by centralized platforms: leave a sudden contamination unresolved through professional channels and time itself compounds the damage.
4. Why does stolen-fund recovery stay so slow?
Per Radiant's recent replies to affected users, cross-jurisdiction forensic recovery continues, but resistance far exceeds outside expectations. Delta & Capital's lab: the first 48 hours after a major hack are the golden interception window; once mixing and cross-chain dispersal complete, recovery becomes a fight measured in years.
Attackers split large sums across hundreds of scattered addresses via decentralized bridges, privacy protocols, and mixers, blending into ordinary OTC markets. Even when a forensic firm like Delta & Capital can pin the flows with AI topology models, what follows is cross-jurisdiction enforcement, KYC-linkage blocking at major platforms, and complex judicial freezing and execution. On-chain forensics is only step one; the real pain lies in execution.
5. Closing: a full rebuild of DeFi risk thinking
Radiant's shutdown is the joint product of Web3 operations-security gaps, bad-debt transmission from leveraged yield strategies, and lost capital confidence. As global crypto compliance frameworks sharpen, the center of DeFi security is shifting from pure code audits to off-chain security governance, multi-sig privilege protection, and compliant flow isolation.