Rhea Finance: $18.4M Drained by 423 Fake Wallets, Then Nearly All of It Came Back

On the morning of 16 April 2026, Rhea Finance, the biggest money app on the NEAR blockchain, started making loans it would never be paid back for. Over about eighty minutes an attacker opened position after position, each one backed by tokens that were worth nothing. By the time the protocol was paused, its emergency reserve was empty.

The first public alert, from the security firm CertiK, put the damage at $7.6 million. A day later Rhea's own post-mortem more than doubled it: about $18.4 million. Then something unusual happened. Within days most of the money had been handed back or frozen, and by Rhea's count the hole left over was a fraction of a million dollars.

Who lost what

Rhea is a DeFi platform. DeFi, short for decentralised finance, means banking services such as lending and trading that run on code instead of through a bank: a smart contract, a program that moves money by itself when its rules are met, plays the part of the loan officer. NEAR is the blockchain it runs on, a public ledger in the same family as Ethereum.

Rhea was born from a merger of NEAR's two oldest money apps: Ref Finance, an exchange where people swap one token for another, and Burrow, a lender. The combined RHEA token launched on 30 July 2025 and replaced their old REF and BRRR tokens. By September 2025 the data site DefiLlama showed about $214 million parked in Rhea's lending side, most of it in NEAR tokens.

The $18.4 million came out of the lending protocol's reserve pool, the cushion that is meant to absorb bad loans, much like a bank's loan-loss provision. Rhea said the exploit caused "realised losses within the protocol" affecting its reserves and users. It paused the lending and exchange contracts. The RHEA token fell to a record low close of about $0.0089 on 19 April.

Two days of building

The attack was planned. According to a breakdown by the audit firm QuillAudits, the attacker funded a main wallet through intents.near, NEAR's cross-chain transfer service, and spread about 71,000 NEAR across 423 helper wallets. Those wallets deployed fake token contracts and set up fresh trading pools on Ref Finance, pairing the fake tokens with real ones: USDC and USDT (both stablecoins, digital dollars, issued by Circle and Tether), wrapped NEAR and Zcash's ZEC. Each pool was seeded at a made-up price. Late on 15 April, 21 of the helper accounts were deleted within 30 seconds, each sending its leftovers to the main wallet.

A fake trading pool is the crypto version of a pawn shop that only ever trades with itself. If the only buyer and the only seller of a token are the same person, its "price" is whatever that person says it is, and any software that trusts the pool trusts that number.

How the money left

The weak spot was Rhea's margin trading feature, which let users borrow to make bigger bets, like a broker's margin account. A margin trade on Rhea could pass through several swaps in a row, and the protocol had a safety check called slippage protection: the user names the minimum they will accept out of each step, and the trade is refused if the total falls short.

The bug was in how that total was added up. Rhea summed the minimum outputs of every step, even when the output of step one was simply spent as the input of step two. QuillAudits' example: a two-step route promising 999 from the first swap and 1 from the second passed a check for 1,000, although the 999 never reached Rhea. It stayed in the attacker's own pool. Rhea described the result as a "deliberately constructed swap route" in which borrowed money was funnelled into the attacker's fake-token pools while almost nothing came back.

Every position was therefore worth far less than its debt from the moment it opened. The protocol liquidated them, selling them off as a broker would with a margin call, and the losses fell on the reserve pool until it was drained. QuillAudits dated the attack transactions from 08:22 to 09:42 UTC. According to QuillAudits, ordinary lending and borrowing were not affected; only the margin trading path was.

The chase

Tether, the company behind USDT, froze about 3.29 million USDT in the attacker's wallet on the day, which its chief executive Paolo Ardoino confirmed on X. A stablecoin issuer can do that because it keeps a list of blocked addresses, much as a bank can freeze an account. A further 1.05 million USDT was frozen inside NEAR Intents, bringing the frozen total to about $4.34 million.

Alex Shevchenko, co-founder of Aurora Labs and NEAR Intents, sent the attacker an on-chain message saying they had been "identified" along with their "associated accounts", and demanded the rest back. On 17 April he thanked the attacker publicly: "This was a right thing to do, sir. Thanks for returning the money."

What came back, according to Rhea's post-mortem as reported by The Block and The Crypto Times: about 3.36 million USDC and 1.56 million NEAR, deposited straight into Rhea's lending contract. On-chain records traced by QuillAudits and The Crypto Times show two more returns: about $3.49 million in USDC on Ethereum late on 17 April, and 13,500 ZEC worth about $4.44 million on the Zcash chain. Rhea's own summary did not list the ZEC line separately, so the exact split was never published in one place.

Adding it all up, QuillAudits put the remaining shortfall at about $0.4 million and reported that Rhea had committed "unconditionally" to cover it. On 8 May Rhea posted what it called the last update before the lending protocol reopened, saying 100% of user balances were accounted for after a reconciliation.

No arrest has been reported, and the attacker has not been publicly named. Shevchenko's claim to have identified them has not been followed by any public charge.

What changed

Rhea permanently shut margin trading on NEAR. The exchange, which was not hit, reopened first, and the fake tokens and pools were removed from it. The lending side was promised a phased return once frozen funds were resolved, contracts upgraded, monitoring bots deployed and the whole product line re-audited. By September 2026 Rhea was shipping new products again, including a cross-chain swap upgrade.

The NEAR ecosystem did not get a quiet year. On 1 October 2026 NEAR Intents itself was drained of about $3.87 million in USDT through a bug in its deposit and withdrawal plumbing, and that money too came back within days.

The pattern in both cases is the same and is not comforting. The theft was fast and the code was trusted. What saved users was not the code but people: a stablecoin company willing to freeze funds, an ecosystem able to put pressure on a thief, and a thief who, for reasons never explained, decided to give most of it back.