The October 2024 exploit of Radiant Capital, which resulted in $58 million in losses, has reignited the conversation around multi-signature wallet security in decentralized finance. While multisig wallets were designed to distribute trust and eliminate single points of failure, the Radiant incident demonstrates that without rigorous operational security practices, even well-architected multisig setups can be compromised. With Bitcoin hovering around $67,300 and Ether at $2,620, the stakes for properly securing protocol treasuries and administrative controls have never been higher.
The Threat Landscape
The current threat environment for DeFi protocols extends far beyond smart contract vulnerabilities. Attackers increasingly target the operational layer — the people, devices, and processes that govern protocol administration. In the Radiant Capital case, the attacker compromised three out of eleven multisig signers through a sophisticated social engineering campaign that delivered malware via Telegram, likely orchestrated by a state-sponsored threat group. This attack pattern mirrors a growing trend observed throughout 2024: threat actors impersonating legitimate business contacts to deliver malware that compromises developer workstations, enabling them to intercept and manipulate multisig transactions at the point of signing.
The implications are significant. A protocol can have perfectly audited smart contracts and still lose tens of millions of dollars if its administrative key management is weak. Other October 2024 incidents reinforce this pattern: unknown attackers exploited a Compound fork on Base for $1.4 million, and multiple BSC-based projects suffered six-figure losses from slippage and burn mechanism vulnerabilities. The common thread is that many of these exploits could have been prevented with stronger operational security at the protocol level.
Core Principles
Effective multisig security begins with understanding that the security chain is only as strong as its weakest link. The first principle is threshold calibration. A 3-of-11 multisig, as Radiant employed, creates an unnecessarily low barrier for compromise. Security professionals generally recommend a minimum threshold of 51% of total signers — meaning a 5-of-7 or 6-of-11 configuration — to ensure that compromising a minority of signers cannot grant control. This dramatically increases the difficulty and cost of mounting a successful attack.
The second principle is signer diversity. Multisig effectiveness depends on the independence of each signer’s security posture. If all signers use the same hardware, software, or communication channels, a single attack vector can compromise multiple signers simultaneously. Effective multisig setups require signers to operate on different operating systems, use different hardware wallets, communicate through separate channels, and ideally reside in different geographic locations.
Tooling & Setup
Implementing robust multisig security requires the right combination of hardware and software tools. At the hardware level, every multisig signer should use a dedicated hardware wallet — devices like Ledger or Trezor that keep private keys isolated from internet-connected computers. The hardware wallet should be used exclusively for multisig operations, not for everyday transactions that might expose it to phishing risks. At the software level, teams should adopt transaction simulation tools that show exactly what a proposed transaction will do before anyone signs it. Services like Tenderly, Foundry simulations, or dedicated multisig dashboards can decode transaction calldata into human-readable actions, making it much harder for a manipulated interface to trick signers into approving malicious operations.
Time locks represent another critical tool. By requiring a mandatory delay between when a transaction is proposed and when it can be executed, protocols give their community and security monitors time to review and flag suspicious activity. A 24-to-48-hour time lock on all administrative transactions would have given Radiant Capital’s team and community time to detect and prevent the attacker’s ownership transfer before funds were drained.
Ongoing Vigilance
Security is not a one-time setup but a continuous process. Protocol teams should implement regular key rotation schedules, changing signer keys on a quarterly basis to limit the window of opportunity for attackers who may have compromised a device without the team’s knowledge. Regular security audits should cover not just smart contract code but also the operational security practices of all team members with administrative access. Automated monitoring systems should watch for unusual administrative transactions, particularly ownership transfers, contract upgrades, or large fund movements. These systems should be configured to alert multiple team members through independent channels when suspicious activity is detected.
Final Takeaway
The Radiant Capital exploit serves as a costly lesson that multi-signature wallets are a security tool, not a security guarantee. Their effectiveness depends entirely on how they are configured, who operates them, and what operational security practices surround their use. As the DeFi industry continues to manage billions of dollars in user funds, the standard for multisig security must evolve beyond the minimum viable configuration. Protocols that invest in robust multisig practices — higher thresholds, hardware wallet mandates, transaction simulation, time locks, and continuous monitoring — will be better positioned to protect their users and maintain the trust that the decentralized finance ecosystem depends on.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before interacting with any DeFi protocol.
the radiants of the world keep learning the hard way that multisig is only as strong as the humans holding the keys
State-sponsored threat group delivering malware via Telegram… this is no longer script kiddies. DeFi teams need actual security teams.