Rhea Finance

What happened

NEAR-based lending and trading protocol Rhea Finance was exploited in mid-April 2026 via a flaw in its margin-trading slippage protection, with losses revised from an initial $7.6 million to about $18.4 million on 17 April.

The attacker constructed a series of swaps that bypassed slippage checks: the system aggregated expected output values across multiple swap steps without accounting for tokens reused across transactions. The swaps diverted borrowed reserve assets into attacker-controlled liquidity pools. Rhea paused its lending contracts, and the attacker returned roughly $3.3 million in USDC and 1.56 million NEAR, while around $4.34 million in USDT was frozen.