Rhea Finance Exploit (April 2026)
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·67C5ok…pWDhSummary
On April 16, 2026, Rhea Finance — the leading DeFi hub on the NEAR blockchain, formed by the March 2025 merger of Ref Finance and Burrow Finance — was exploited for an estimated $18.4 million (initially reported as $7.6 million) via a two-phase attack combining fake token pool seeding with a slippage-protection bypass in its margin trading module. Approximately $9 million in assets was subsequently recovered or frozen, including $3.291 million USDT frozen by Tether, leaving an estimated $8–9 million outstanding as of late April 2026.
Connected Entities
10 entities · 60 linked investigations- Ethereum→mentioned with→Bitcoin(60%)
- Cream Finance→mentioned with→Ethereum(70%)
- Cream Finance→mentioned with→Bitcoin(65%)
- Harvest Finance→mentioned with→Bitcoin(75%)
- Harvest Finance→mentioned with→Ethereum(65%)
- Rhea Finance Exploit (April 2026)→mentioned with→Tether(70%)
- Rhea Finance Exploit (April 2026)→mentioned with→Solana(60%)
- Rhea Finance Exploit (April 2026)→mentioned with→KyberSwap(65%)
- Rhea Finance Exploit (April 2026)→mentioned with→Bitcoin(60%)
- Rhea Finance Exploit (April 2026)→mentioned with→Ethereum(80%)
- + 12 more
Timeline(7 events)
March 2025
Ref Finance and Burrow Finance announce merger to form Rhea Finance, the chain-abstracted DeFi hub on NEAR Protocol.
Bitcoin.com News13 April 2026
Alleged attacker begins preparation phase: funds primary wallet via cross-chain transfers, distributes funds across 423 intermediary wallets, deploys fake token contracts, and creates eight fraudulent trading pools on Ref Finance.
CoinEdition / Rhea Finance Post-Mortem16 April 2026
Exploit executed: attacker uses slippage protection bypass in margin trading module to drain the protocol's reserve pool. Initial losses estimated at $7.6 million by CertiK. Rhea Finance pauses lending contracts.
CryptoTimes / CertiK16 April 2026
Tether CEO Paolo Ardoino confirms Tether froze $3.291 million USDT in the attacker's wallet. A further $1.053 million USDT frozen in NEAR Intents.
TronWeekly / MEXC News17 April 2026
Rhea Finance publishes preliminary analysis. Recovery efforts begin; protocol works with centralized exchanges and security experts.
CryptoTimes Fact-Check18 April 2026
Rhea Finance releases full post-mortem revising total losses to $18.4 million. Attacker identified as having returned approximately $3.359 million USDC and 1.564 million NEAR to the lending contract. Near Intents team states attacker has been identified; formal CEX tracing initiated.
The Block / AMBCrypto / The Coin Republic18 April 2026
CryptoTimes fact-check rates as 'partly true' claims that all funds were returned. Total recovered or frozen approximately $9 million of $18.4 million; approximately $8–9 million remains outstanding.
CryptoTimesDecision Log
- slot 425403836 · hash 6kS1vMc5Yt9ZnuZbGGwfLipix7Rd2hWHdB74BLhBpQXb
- slot 425403833 · hash D57fuu3pHurbSB9s8mL3zH7Zc9LN4QpsWAhrV7kF18D9
- slot 425010388 · hash 4Vuz3HnhPUsTu3wAPNWZpXbHAkA7wRj8b1fxgLKkYumA
This investigation is cryptographically anchored to the Solana blockchain (3 decisions). 23 of 24 cited source URLs have an Internet Archive snapshot.
model: claude-code-investigator
generated: 6/8/2026, 1:22:04 AM
last updated: 6/8/2026, 1:22:04 AM
3 viewsavoid.net — verified advice for a post-truth world