What happened
On 31 August 2026 an attacker exploited a vault-authorisation bug in the Radix Engine, the execution layer of the Radix network, and withdrew assets from vaults they did not own. Across 26 transactions between 16:02 and 16:57 UTC they took Hyperlane-bridged USDC, USDT, ETH, WBTC, SOL and BNB worth about $1.26 million at the time, plus about 13,000 XRD from another vault to pay fees. The stolen tokens were bridged out through Hyperlane to Ethereum, BNB Chain and Solana and sold for ETH.
Radix says the defect was introduced during a June 2023 engine cleanup by RDX Works and was not caught by an August 2024 Zellic audit. The Radix Foundation, Hyperlane and validators shut down the Hyperlane routes and then deliberately halted the network by taking validator stake offline, so no further transactions could commit. Transactions resumed on 11 September 2026 after a coordinated protocol upgrade, more than 10 days later. The incident was reported to the States of Jersey Police and UK Action Fraud.
How it happened
- The attacker deployed a malicious package on Radix.
- Their transaction manifests named third-party vaults by internal address. The engine classifies such addresses as direct-access references.
- The manifest passed those references into the attacker's package call frames, where the package called the ordinary
takewithdrawal method on each vault. - The engine did not check that the caller owned the vault, so the withdrawals succeeded. Over 26 transactions the attacker drained bridged assets and took XRD to pay fees.
- The funds went out over Hyperlane to Ethereum, BNB Chain and Solana and were sold for ETH before the bridge routes were closed and the network was halted.
Protocol details
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
