Audit log

Every state-changing event for Rhea Lend: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions carry three independent witnesses — the original source, an Internet Archive snapshot taken at submission time, and a Solana memo signed by our publicly-disclosed publisher key.

1. #1publishby system:backfill

   2026-05-19 20:13:19Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 420,839,288

   sig

   4u4gkHqgLf6U…Hi76TQBhcopyexplorer ↗

   hash

   36JvVdojUFhq…jEWjhqAQcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (5986 B) ▸

   {"actor":"system:backfill","investigation_id":"9b3955d1-a1de-427d-bfb0-14671152301d","kind":"publish","page_slug":"rhea-lend","published_at":"2026-05-19T20:13:19.058Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Rhea Lend","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://iq.wiki/wiki/rhea-finance"},{"credibility":3,"name":"","type":"other","url":"https://learnnear.club/introducing-rhea-finance/"},{"credibility":3,"name":"","type":"other","url":"https://www.near.org/blog/rhea-finance-debuts-rhea-token-unifying-nea-rs-leading-de-fi-protocols-with-chain-abstracted-liquidity"},{"credibility":3,"name":"","type":"other","url":"https://defillama.com/protocol/rhea-finance"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://guide.rhea.finance/docs/rhea-finance-white-paper"},{"credibility":3,"name":"","type":"other","url":"https://defillama.com/protocol/rhea-finance"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://guide.rhea.finance/developers/audits"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-rhea-finance-hack-april-2026"},{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/397961/rhea-finance-post-mortem-exploit-losses-18-4-million-double-initial-estimates"},{"credibility":3,"name":"","type":"other","url":"https://coinedition.com/18-4m-rhea-finance-hack-built-over-two-days-post-mortem-reveals/"},{"credibility":3,"name":"","type":"other","url":"https://www.cryptotimes.io/2026/04/18/hacker-returns-all-the-funds-to-rhea-finance-fact-check/"},{"credibility":3,"name":"","type":"other","url":"https://www.cryptotimes.io/2026/04/16/rhea-finance-loses-7-6m-in-exploit-says-certik/"},{"credibility":3,"name":"","type":"other","url":"https://phemex.com/news/article/rhea-finance-suffers-184-million-exploit-due-to-slippage-protection-flaw-74100"},{"credibility":3,"name":"","type":"other","url":"https://www.web3isgoinggreat.com/single/rhea-finance-exploit"},{"credibility":3,"name":"","type":"other","url":"https://ambcrypto.com/rhea-finance-revises-exploit-losses-to-18-4m-confirms-slippage-flaw-as-funds-partially-recovered/"},{"credibility":3,"name":"","type":"other","url":"https://www.mexc.com/news/1036012"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://iq.wiki/wiki/rhea-finance"},{"credibility":3,"name":"","type":"other","url":"https://learnnear.club/introducing-rhea-finance/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-rhea-finance-hack-april-2026"},{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/397961/rhea-finance-post-mortem-exploit-losses-18-4-million-double-initial-estimates"},{"credibility":3,"name":"","type":"other","url":"https://www.ccn.com/education/crypto/defi-hacks-2026-137m-lost-step-finance-truebit-resolv-exploits/"},{"credibility":3,"name":"","type":"other","url":"https://www.coingabbar.com/en/crypto-currency-news/rhea-finance-crypto-hack-update-near-defi-rhea-token-price-drop"}]}],"sources_used":[],"summary":"Rhea Lend is the lending arm of Rhea Finance, a DeFi protocol on NEAR Protocol formed in early 2025 through the merger of Ref Finance and Burrow Finance. In April 2026, Rhea Lend suffered a major exploit in which an attacker drained approximately $18.4 million by exploiting a flaw in the protocol's slippage protection mechanism via a fake-token pool manipulation scheme. Partial recovery of approximately $9–13 million was achieved through voluntary returns and asset freezes, but the incident represents a critical security failure on an audited protocol.","timeline":[{"date":"2025-02-01","event":"Ref Finance and Burrow Finance announce merger to form Rhea Finance on NEAR Protocol","source":""},{"date":"2025-02-19","event":"Trail of Bits completes smart contract audit of Ref Finance DeFi protocol","source":""},{"date":"2025-03-01","event":"Rhea Finance merger formally announced; $RHEA token introduced as unified governance token","source":""},{"date":"2025-04-02","event":"BlockSec completes audit of Burrow Margin Trading module","source":""},{"date":"2025-08-05","event":"BlockSec completes audit of rNEAR Contract","source":""},{"date":"2025-10-09","event":"Resonance Security completes audit of Liquid Staking Protocol","source":""},{"date":"2026-04-13","event":"Attacker begins two-day preparation: creates 423 intermediary wallets and eight fake token pools on Ref Finance","source":""},{"date":"2026-04-16","event":"Exploit executed: attacker exploits slippage protection flaw in margin trading, draining approximately $7.6 million (initial estimate) from Rhea Lend; CertiK flags the incident; RHEA token price drops approximately 8%","source":""},{"date":"2026-04-17","event":"Additional on-chain activity observed: ~$3.49 million in AAVE USDC V3 tokens moved on Ethereum; attacker returns $3.359 million USDC and $1.564 million NEAR to Rhea Lend contract","source":""},{"date":"2026-04-18","event":"Post-mortem published revising total losses to $18.4 million; Tether freezes $3.291 million USDT in attacker wallet; NEAR Intents freezes additional $1.053 million USDT; Halborn and The Block publish detailed exploit analyses","source":""},{"date":"2026-04-18","event":"Near Intents team states attacker may be identifiable with public social media presence; centralized exchanges notified to assist tracing","source":""},{"date":"2026-05-19","event":"Protocol TVL stands at approximately $120.96 million; compensation framework described as 'in development' with no specifics disclosed; estimated $5.4–9.4 million in losses remain unaccounted for","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision a88ddbb9-bd80-479c-9085-3b48edf68c80copy