Curriculum·G206 Running a Security Review for a Small Team·about 31 min
The review a small team can actually run
By the end of this lesson you can
- →Distinguish a small team's realistic security review from a formal audit, and state what each can and cannot do
- →Explain how Radiant Capital lost about 50 million dollars with every recommended control in place
- →Compute why a control is only as good as the step that verifies it was actually followed
- →Assemble a repeatable review a small team can run over the risks it actually controls
Graduate · enrolled learners
This lesson opens with Radiant Capital, 16 October 2024.
- What happened
- Radiant Capital is a cross-chain lending protocol run by a small distributed team. On 16 October 2024 about 50 million dollars was taken. Three long-standing developers, in different countries, each signing on a hardware wallet, approved what their Gnosis Safe front-end displayed as a routine transaction. Malware on their machines showed the legitimate payload on screen while sending a different one to the hardware wallet for signature, and the protocol's 3-of-11 multisig authorized a malicious contract upgrade that handed control to the attacker. Mandiant attributed the operation to a North Korea-aligned group that had begun a month earlier with a Telegram message impersonating a trusted former contractor. Every control a careful small team is told to use, hardware wallets, a multisig, geographic spread, was in place, and the review process had no step that verified what each device was actually being asked to sign.
- The decision point
- Radiant did not fail for lack of controls; it had the ones every checklist recommends. It failed because having a control and verifying the control was followed are different things, and its process checked the first and not the second. A hardware wallet protects a key only if the signer verifies, on the device, that the payload matches the intent, and Radiant's review had no such step. This is the lesson of the whole course: a small team cannot run a formal audit, and it can run a review, a short, repeatable check of the risks it controls, provided the review verifies that each control actually did its job rather than assuming it did. The value is not in listing controls a team already knows to want. It is in the step that catches the day a control was present and defeated.
- Recorded loss
- $50,000,000
What you will be able to answer
- →What controls did Radiant have when it was drained?
- →How was the Radiant multisig defeated?
- →What can a small team's security review realistically be?
- →Having a control versus verifying it?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://rekt.news/radiant-capital-rekt2/
- https://medium.com/@RadiantCapital/radiant-post-mortem-fecd6cd38081
- https://www.mandiant.com/resources/blog
Confidence high·Volatility medium·Reviewed 2026-09-14·Owner unassigned
Contested
The Radiant loss is reported at about 50 million dollars; figures vary slightly by source and asset prices. The mechanism, malware displaying a benign payload while forwarding a malicious one to the hardware wallet, is described in Radiant's own post-mortem and in the Mandiant attribution.
This lesson uses Radiant for the distinction between having a control and verifying it; the exact malware and delivery details were still being analyzed after the incident and some specifics may be refined.