Rhea Finance
Summary
Rhea Finance is a chain-abstracted DeFi liquidity hub on the NEAR Protocol, formed in early 2025 through the merger of Ref Finance and Burrow Finance. On April 16, 2026, the protocol suffered a major exploit in which an attacker bypassed slippage protection in its margin trading module using intermediate asset reuse across a chain swap path, ultimately draining an estimated $18.4 million from the reserve pool — more than double the initial $7.6 million estimate. Approximately $9.2 million was subsequently returned or frozen, with the remainder still outstanding as of mid-2026; a compensation framework was announced but had not been finalized at the time of publication.
Connected Entities
1 entities · 10 linked investigationsTimeline(6 events)
2025-03-01
Ref Finance and Burrow Finance announce merger to form Rhea Finance, NEAR Protocol's unified DeFi liquidity hub.
Rhea Finance Medium / NEAR Protocol2026-04-13
Attacker begins exploit preparation: creates subject wallet, begins distributing funds across 423 intermediary wallets, deploys fake token contracts, and establishes eight fraudulent trading pools on Ref Finance.
Coin Edition / Post-Mortem2026-04-16
Exploit executed: attacker exploits slippage protection bypass in Rhea Finance's margin trading module, draining the reserve pool. CertiK reports initial loss of approximately $7.6 million. Rhea Finance pauses lending contracts.
Crypto Times / CertiK2026-04-16
Tether CEO Paolo Ardoino announces approximately $3.29 million in USDT connected to the attacker has been frozen.
BeInCrypto2026-04-17
Rhea Finance releases post-mortem revising total losses upward to $18.4 million — more than double the initial estimate — and confirming the slippage protection flaw as root cause. Attacker returns approximately $3.359 million USDC and $1.564 million NEAR to lending contract.
The Block / AMBCrypto2026-04-18
Aurora Labs and Near Intents co-founder Alex Shevchenko sends on-chain message to attacker stating identification and associated accounts have been traced; formal traces opened with centralized exchanges. Crypto Times fact-check finds claims of full fund recovery unverified.
Crypto Times Fact Check / Coin EditionDecision Log
- hash: 87MbNFB1a9G8FYGFQVTTxoaaGcwb2PiRnqhri3vxR1e9
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 6/19/2026, 12:12:02 PM
last updated: 6/19/2026, 12:12:11 PM
avoid.net — verified advice for a post-truth world