Radix Engine Vault Vulnerability Exposes: Execution Layer Flaw Triggers Chain Halt

The Refactoring Trap: Why Routine Code Maintenance Is Crypto's Most Dangerous Attack Vector

The safest smart contract engine is only one routine cleanup away from complete insolvency.

A routine code refactor initiated by the RDX Works development team in June 2023 silently introduced a critical vault authorization vulnerability into the Radix Engine. This defect went undetected for over three years before an attacker exploited it on August 31, 2026, executing 26 transactions to drain approximately $1.26 million in assets, including 458,915 USDC, 72,420 USDT, 61.08 ETH, 6.35 wrapped Bitcoin, 536.16 SOL, and 32.91 BNB. To prevent systemic contagion across all network vaults, validators deliberately took their stake offline, initiating an emergency network halt that froze the blockchain for over 10 days until a patch was deployed on September 11, 2026.

The stolen assets were routed through Hyperlane to Ethereum, BNB Chain, and Solana, where they were liquidated for ETH. While the bridge operated exactly as designed, the exploit bypassed the core asset-ownership boundaries of the Radix execution layer itself. This security failure occurred despite a comprehensive protocol audit conducted by Zellic in 2024, highlighting a profound disconnect between static security reviews and the dynamic risks of protocol