Rhea Finance Exploit (April 2026)
Summary
On April 16, 2026, Rhea Finance — the leading DeFi hub on the NEAR blockchain, formed by the March 2025 merger of Ref Finance and Burrow Finance — was exploited for an estimated $18.4 million (initially reported as $7.6 million) via a two-phase attack combining fake token pool seeding with a slippage-protection bypass in its margin trading module. Approximately $9 million in assets was subsequently recovered or frozen, including $3.291 million USDT frozen by Tether, leaving an estimated $8–9 million outstanding as of late April 2026.
Connected Entities
1 entities · 10 linked investigationsTimeline(7 events)
2025-03-01
Ref Finance and Burrow Finance announce merger to form Rhea Finance, the chain-abstracted DeFi hub on NEAR Protocol.
Bitcoin.com News2026-04-13
Alleged attacker begins preparation phase: funds primary wallet via cross-chain transfers, distributes funds across 423 intermediary wallets, deploys fake token contracts, and creates eight fraudulent trading pools on Ref Finance.
CoinEdition / Rhea Finance Post-Mortem2026-04-16
Exploit executed: attacker uses slippage protection bypass in margin trading module to drain the protocol's reserve pool. Initial losses estimated at $7.6 million by CertiK. Rhea Finance pauses lending contracts.
CryptoTimes / CertiK2026-04-16
Tether CEO Paolo Ardoino confirms Tether froze $3.291 million USDT in the attacker's wallet. A further $1.053 million USDT frozen in NEAR Intents.
TronWeekly / MEXC News2026-04-17
Rhea Finance publishes preliminary analysis. Recovery efforts begin; protocol works with centralized exchanges and security experts.
CryptoTimes Fact-Check2026-04-18
Rhea Finance releases full post-mortem revising total losses to $18.4 million. Attacker identified as having returned approximately $3.359 million USDC and 1.564 million NEAR to the lending contract. Near Intents team states attacker has been identified; formal CEX tracing initiated.
The Block / AMBCrypto / The Coin Republic2026-04-18
CryptoTimes fact-check rates as 'partly true' claims that all funds were returned. Total recovered or frozen approximately $9 million of $18.4 million; approximately $8–9 million remains outstanding.
CryptoTimesDecision Log
- hash: 4Vuz3HnhPUsTu3wAPNWZpXbHAkA7wRj8b1fxgLKkYumA
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-code-investigator
generated: 6/8/2026, 1:22:04 AM
last updated: 6/8/2026, 1:22:09 AM
avoid.net — verified advice for a post-truth world