Rhea Finance
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·2t11s1…uJnESummary
Rhea Finance is a chain-abstracted DeFi liquidity hub on the NEAR Protocol, formed in early 2025 through the merger of Ref Finance and Burrow Finance. On April 16, 2026, the protocol suffered a major exploit in which an attacker bypassed slippage protection in its margin trading module using intermediate asset reuse across a chain swap path, ultimately draining an estimated $18.4 million from the reserve pool — more than double the initial $7.6 million estimate. Approximately $9.2 million was subsequently returned or frozen, with the remainder still outstanding as of mid-2026; a compensation framework was announced but had not been finalized at the time of publication.
Connected Entities
1 entity · 3 linked investigationsConnected Through
1 shared actor · 3 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- ⌂Rhea Financeprotocol
Timeline(6 events)
March 2025
Ref Finance and Burrow Finance announce merger to form Rhea Finance, NEAR Protocol's unified DeFi liquidity hub.
Rhea Finance Medium / NEAR Protocol13 April 2026
Attacker begins exploit preparation: creates subject wallet, begins distributing funds across 423 intermediary wallets, deploys fake token contracts, and establishes eight fraudulent trading pools on Ref Finance.
Coin Edition / Post-Mortem16 April 2026
Exploit executed: attacker exploits slippage protection bypass in Rhea Finance's margin trading module, draining the reserve pool. CertiK reports initial loss of approximately $7.6 million. Rhea Finance pauses lending contracts.
Crypto Times / CertiK16 April 2026
Tether CEO Paolo Ardoino announces approximately $3.29 million in USDT connected to the attacker has been frozen.
BeInCrypto17 April 2026
Rhea Finance releases post-mortem revising total losses upward to $18.4 million — more than double the initial estimate — and confirming the slippage protection flaw as root cause. Attacker returns approximately $3.359 million USDC and $1.564 million NEAR to lending contract.
The Block / AMBCrypto18 April 2026
Aurora Labs and Near Intents co-founder Alex Shevchenko sends on-chain message to attacker stating identification and associated accounts have been traced; formal traces opened with centralized exchanges. Crypto Times fact-check finds claims of full fund recovery unverified.
Crypto Times Fact Check / Coin EditionDecision Log
- hash: 87MbNFB1a9G8FYGFQVTTxoaaGcwb2PiRnqhri3vxR1e9
This investigation is cryptographically anchored to the Solana blockchain (1 event). 12 of 14 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 6/19/2026, 12:12:02 PM
last updated: 7/28/2026, 6:38:21 AM
3 viewsavoid.net — verified advice for a post-truth world