Rhea Finance Exploit (April 2026)
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·67C5ok…pWDhSummary
On April 16, 2026, Rhea Finance — the leading DeFi hub on the NEAR blockchain, formed by the March 2025 merger of Ref Finance and Burrow Finance — was exploited for an estimated $18.4 million (initially reported as $7.6 million) via a two-phase attack combining fake token pool seeding with a slippage-protection bypass in its margin trading module. Approximately $9 million in assets was subsequently recovered or frozen, including $3.291 million USDT frozen by Tether, leaving an estimated $8–9 million outstanding as of late April 2026.
Connected Entities
1 entitiesTimeline(7 events)
March 2025
Ref Finance and Burrow Finance announce merger to form Rhea Finance, the chain-abstracted DeFi hub on NEAR Protocol.
Bitcoin.com News13 April 2026
Alleged attacker begins preparation phase: funds primary wallet via cross-chain transfers, distributes funds across 423 intermediary wallets, deploys fake token contracts, and creates eight fraudulent trading pools on Ref Finance.
CoinEdition / Rhea Finance Post-Mortem16 April 2026
Exploit executed: attacker uses slippage protection bypass in margin trading module to drain the protocol's reserve pool. Initial losses estimated at $7.6 million by CertiK. Rhea Finance pauses lending contracts.
CryptoTimes / CertiK16 April 2026
Tether CEO Paolo Ardoino confirms Tether froze $3.291 million USDT in the attacker's wallet. A further $1.053 million USDT frozen in NEAR Intents.
TronWeekly / MEXC News17 April 2026
Rhea Finance publishes preliminary analysis. Recovery efforts begin; protocol works with centralized exchanges and security experts.
CryptoTimes Fact-Check18 April 2026
Rhea Finance releases full post-mortem revising total losses to $18.4 million. Attacker identified as having returned approximately $3.359 million USDC and 1.564 million NEAR to the lending contract. Near Intents team states attacker has been identified; formal CEX tracing initiated.
The Block / AMBCrypto / The Coin Republic18 April 2026
CryptoTimes fact-check rates as 'partly true' claims that all funds were returned. Total recovered or frozen approximately $9 million of $18.4 million; approximately $8–9 million remains outstanding.
CryptoTimesDecision Log
- hash: 6kS1vMc5Yt9ZnuZbGGwfLipix7Rd2hWHdB74BLhBpQXb
- hash: D57fuu3pHurbSB9s8mL3zH7Zc9LN4QpsWAhrV7kF18D9
- hash: 4Vuz3HnhPUsTu3wAPNWZpXbHAkA7wRj8b1fxgLKkYumA
This investigation is cryptographically anchored to the Solana blockchain (3 events). 23 of 24 cited source URLs have an Internet Archive snapshot.
model: claude-code-investigator
generated: 6/8/2026, 1:22:04 AM
last updated: 7/27/2026, 5:00:40 PM
3 viewsavoid.net — verified advice for a post-truth world