Summary
Rhea Lend is the lending arm of Rhea Finance, a DeFi protocol on NEAR Protocol formed in early 2025 through the merger of Ref Finance and Burrow Finance. In April 2026, Rhea Lend suffered a major exploit in which an attacker drained approximately $18.4 million by exploiting a flaw in the protocol's slippage protection mechanism via a fake-token pool manipulation scheme. Partial recovery of approximately $9–13 million was achieved through voluntary returns and asset freezes, but the incident represents a critical security failure on an audited protocol.
Connected Entities
1 entities- + 1 more
Timeline(12 events)
2025-02-01
Ref Finance and Burrow Finance announce merger to form Rhea Finance on NEAR Protocol
2025-02-19
Trail of Bits completes smart contract audit of Ref Finance DeFi protocol
2025-03-01
Rhea Finance merger formally announced; $RHEA token introduced as unified governance token
2025-04-02
BlockSec completes audit of Burrow Margin Trading module
2025-08-05
BlockSec completes audit of rNEAR Contract
2025-10-09
Resonance Security completes audit of Liquid Staking Protocol
2026-04-13
Attacker begins two-day preparation: creates 423 intermediary wallets and eight fake token pools on Ref Finance
2026-04-16
Exploit executed: attacker exploits slippage protection flaw in margin trading, draining approximately $7.6 million (initial estimate) from Rhea Lend; CertiK flags the incident; RHEA token price drops approximately 8%
2026-04-17
Additional on-chain activity observed: ~$3.49 million in AAVE USDC V3 tokens moved on Ethereum; attacker returns $3.359 million USDC and $1.564 million NEAR to Rhea Lend contract
2026-04-18
Post-mortem published revising total losses to $18.4 million; Tether freezes $3.291 million USDT in attacker wallet; NEAR Intents freezes additional $1.053 million USDT; Halborn and The Block publish detailed exploit analyses
2026-04-18
Near Intents team states attacker may be identifiable with public social media presence; centralized exchanges notified to assist tracing
2026-05-19
Protocol TVL stands at approximately $120.96 million; compensation framework described as 'in development' with no specifics disclosed; estimated $5.4–9.4 million in losses remain unaccounted for
Decision Log
- hash: 36JvVdojUFhqRCsXWFawZW1SGWtBRdV3aj2jjEWjhqAQ
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:11 AM
last updated: 5/19/2026, 8:13:19 PM
avoid.net — verified advice for a post-truth world