Rhea Finance Exploit: Slippage Protection Logic Flaw Drains ~$18.4M on NEAR

On April 16, 2026, Rhea Finance — a lending protocol on the NEAR blockchain — was exploited via a logic flaw in its slippage protection mechanism, resulting in approximately $18.4 million drained from its reserve pool. The attacker spent two days preparing the exploit before execution. The vulnerability allowed the same intermediate token value to be counted multiple times during multi-step swaps, making positions appear sufficiently collateralized when they were not. This enabled the attacker to borrow against inflated values and extract real assets from the protocol.

Liquidity providers in affected pools experienced direct losses, and the protocol’s native token RHEA declined sharply in value. The exploit triggered cascading liquidations across the system, fully draining the reserve pool. Approximately $9 million has been recovered or frozen, including $3.29 million USDT frozen by Tether. However, around $8.4 million remains unrecovered, and compensation details have not yet been finalized.