The Radix blockchain resumed operations on September 11, 2026, following a 10-day network halt triggered by a $1.3 million exploit on August 31, 2026. The incident stemmed from a vault authorization vulnerability introduced during a June 2023 code refactor by RDX Works, which went undetected during a 2024 security audit by Zellic. Validators deliberately halted consensus to protect assets before developers deployed a protocol fix.
Radix blockchain exploit halt
- ▪The Radix blockchain was halted for more than 10 days after an attacker exploited a vulnerability on August 31, 2026, to steal approximately $1.3 million in assets.
- ▪The 10-day Radix blockchain halt triggered by the August 31, 2026 exploit ended and user transactions resumed on September 11, 2026, after developers deployed a protocol fix
2023 code refactor vulnerability
- ▪The June 2023 Radix Engine vault authorization bug allowed transactions to bypass ownership boundaries and execute ordinary withdrawal functions on other users' vaults without their signatures
- ▪An RDX Works development team introduced a vault authorization vulnerability during a June 2023 cleanup and code refactor of the Radix Engine
Stolen bridged asset transfers
- ▪An attacker who exploited the Radix Engine vault vulnerability on August 31, 2026 transferred the assets stolen from Radix through the Hyperlane bridge to Ethereum, BNB Chain, and Solana, where they were sold for ETH
- ▪An attacker who exploited a vault authorization vulnerability introduced into the Radix Engine during a June 2023 code refactor executed 26 transactions on August 31, 2026, withdrawing approximately 458,915 USDC, 72,420 USDT, 61.08 ETH, 6.35 wrapped Bitcoin, 536.16 SOL, 32.91 BNB, and 13,000 XRD
Zellic audit missed flaw
- ▪An independent security audit of the Radix protocol conducted by Zellic in 2024 failed to detect a vault authorization vulnerability, introduced during a June 2023 code refactor, in the Radix Engine kernel
- ▪The Radix Foundation stated that the vault authorization vulnerability survived Zellic's 2024 audit despite the defective code having been introduced during the previous year's refactor
Validator emergency protocol fix
- ▪Radix network validators deliberately took enough stake offline to prevent consensus and halt transaction finalization once the vault authorization vulnerability exploited on August 31, 2026 was identified as an execution-layer flaw
- ▪The protocol fix deployed by developers after the August 31, 2026 exploit added checks that prevent restricted vault references from being used for ordinary withdrawals on the Radix network
Security review process improvements
- ▪The Radix Foundation is adding regression tests, strengthening its security review process, and formalizing the emergency validator procedures used to halt the Radix network during the August 31, 2026 exploit
- ▪The Radix Foundation stated that future security reviews must account for AI-assisted code-analysis tools, which they believe may have helped the attacker who exploited the Radix Engine on August 31, 2026 find the vault authorization vulnerability introduced in June 2023
Debatable claims
- ▪Radix validators were justified in halting the network to stop the exploit
- ▪Security auditors should be held financially liable for missed blockchain vulnerabilities
Story comments
Loading comments…