Radix Foundation said it has fixed the vault authorization vulnerability behind the August 31 attack that let an attacker withdraw assets from third-party vaults without owner consent and route them to external chains through Hyperlane for sale.

According to the foundation’s incident report, the attacker exploited a previously undetected authorization flaw in the Radix Engine, the network’s execution layer, to remove assets from vaults owned by third-party packages and accounts. The stolen assets included ETH, WBTC, USDT, USDC, BNB, SOL, and a small amount of XRD used for transaction fees.

Radix said the assets were then transferred through the Hyperlane cross-chain bridge to an external chain and sold for ETH. The foundation said Hyperlane itself, its validators, and its message verification process operated correctly, and that the theft happened on Radix before the bridge was used. It also said no admin, recall, or clawback permissions were abused.

The foundation traced the vulnerability to a code cleanup in June 2023. It added that an independent security audit conducted by Zellic in August 2024 did not identify the issue. Radix said the first signs of the exploit were spotted by community members running validator nodes, who saw bridged assets being drained and escalated the matter to the team.

In response, Hyperlane suspended operations related to Radix, while validators voluntarily took enough staked shares offline to interrupt network activity and stop further exploitation. Radix said the fix has since gone through independent review and testing, and that network restoration is now in progress. The available information does not include a total value of stolen assets or a reimbursement plan.

Why It Matters

The incident highlights how execution-layer authorization bugs can cascade into cross-chain losses even when bridge infrastructure is functioning as designed. For projects relying on bridged asset liquidity, the event underscores that security assumptions extend beyond the bridge itself to the source chain’s core application and vault logic.

It also raises fresh questions about audit coverage and incident response design. Radix’s disclosure that the bug originated in 2023 and was missed by a later independent audit is likely to sharpen scrutiny on how protocol teams review execution-layer changes, monitor validator-side anomalies, and coordinate emergency shutdown measures when multiple ecosystem assets are at risk.