A previously undiscovered vulnerability in the Radix Engine enabled an attacker to withdraw roughly $1.26 million in crypto from third-party vaults on Aug. 31 without obtaining owners' authorization. The stolen assets included 458,915 USDC, 72,420 USDT, 61.08 ETH, 6.35 wrapped Bitcoin, 536.16 SOL and 32.91 BNB across 26 transactions, along with 13,000 XRD used to pay transaction fees. The flaw originated during a June 2023 code cleanup and was not identified during Zellic's independent 2024 security audit. By referencing another user's vault through its internal address, an attacker could invoke ordinary withdrawal functions without the Radix Engine enforcing the required ownership boundary or requiring the owner's signature. The exposure extended to user accounts, applications and liquidity pools. The attacker moved the assets through Hyperlane to Ethereum, BNB Chain and Solana before selling them. About three hours after the incident, Radix validators took enough stake offline to prevent the network from continuing to reach consensus and stop further exploitation. Radix says the vulnerability has been fixed, independently reviewed and tested, while network recovery is under way. The existing record says user transactions resumed Sept. 11 after the fix; the latest incident report describes recovery as ongoing.