Radix discloses vault-authorization bug after $1.26 million drain and 10-day halt
The Radix Foundation says a 2023 engine refactor let an attacker withdraw from third-party vaults; validators broke network liveness while the protocol was fixed.
The Radix Foundation disclosed a vault-authorization vulnerability in the Radix Engine after an attacker withdrew roughly $1.26 million in digital assets on Aug. 31. The Foundation’s public incident report says the defect was introduced during a June 2023 code tidy-up and remained undetected until the exploit.
The attacker executed 26 transactions and withdrew bridged USDC, USDT, ETH, wrapped bitcoin, SOL and BNB from third-party vaults. The Foundation says the assets were then routed through Hyperlane and sold on external chains. CryptoSlate independently reviewed the incident and reported a similar asset breakdown and loss estimate.
The distinction matters because the bridge was not the source of the theft. The bug sat in Radix’s ownership boundary. A transaction could name another vault by its internal address, pass the reference into smart-contract code and call an ordinary withdrawal method without the owner’s authorization.
Validators chose to stop liveness
Once investigators determined that the defect affected the execution layer rather than one application, Radix said any vault on the network could have been exposed. The Foundation, Hyperlane and validator operators shut down bridge routes, then coordinated to take enough validator stake offline that consensus could no longer commit transactions.
That response lasted more than 10 days. Radix’s report says the network resumed after a protocol and node-software fix was independently reviewed and tested. The network was not rolled back, and the report says no further unauthorized withdrawals were identified after liveness was broken.
A deliberate loss of liveness is a severe operational event even when it limits losses. Users could not rely on normal transaction finality, exchanges had to pause activity and liquidity providers faced uncertainty about prices and withdrawals. The incident therefore tests governance and recovery procedures as much as code security.
The audit did not catch the defect
Radix says the vulnerability survived an independent Zellic audit of the protocol in August 2024. The Foundation’s account is that the defect arose from the interaction of direct-access references, borrowed call frames and ordinary vault methods—an authorization path that routine review did not reject.
The Foundation says it added unit and integration tests, strengthened review of security-critical refactors and formalized the emergency procedure used by validators. It also reported the incident to the States of Jersey Police and UK law enforcement and supplied forensic evidence.
The next evidence is an independent reconstruction of affected vaults, any compensation or recovery plan, and continued operation under the patch. An audit is evidence, not a guarantee. The incident does not prove every Radix component is unsafe, but it shows how a small change in authorization logic can create system-wide exposure years later.
