Rhea Finance exploit drains $18.4M; $5.6M missing

On Thursday Rhea Finance reported a margin-trading exploit that removed about $18.4 million from its lending protocol, leaving an estimated $5.6 million unaccounted for. The team published a post-mortem on Friday with technical details and updates.

Rhea explained the attacker used a “deliberately constructed swap route” to open a large number of margin positions. Borrowed debt tokens were redirected into attacker-controlled fake token pools while only a negligible amount of position tokens returned to the protocol. Many positions became undercollateralized, triggering liquidations that depleted the protocol’s reserve liquidity pool. Rhea described the impact as “realised losses within the protocol,” affecting reserves and users.

The protocol paused the affected contracts immediately. Rhea said it is working with exchanges and investigators to trace the outstanding token value and is developing a compensation and recovery framework, but provided no timeline or details on compensation mechanics.

A portion of the funds has been recovered or frozen. The attacker returned roughly 3.36 million USDC and 1.56 million NEAR, valued at about $3.5 million. Separately, about 4.34 million USDT has been frozen, a step confirmed by Tether CEO Paolo Ardoino. Rhea put the remaining amount at roughly $5.6 million.

Earlier public estimates placed losses at about $7.6 million; the post-mortem raised the total to $18.4 million. Alex Shevchenko, co-founder of Near Intents and associated with Aurora Labs, posted an onchain message to the attacker saying he had “identified you and your associated accounts” and urged the return of the remaining assets. Rhea and its partners continue to trace onchain movements to freeze or reclaim funds where possible.

Margin trading allows users to borrow assets to amplify positions, using collateral to back loans. If collateral falls below required thresholds, liquidations occur to repay lenders; a wave of liquidations can exhaust a protocol’s reserve pool. Rhea’s report attributes the exploit to the manipulated swap path that diverted borrowed tokens into controlled pools and prevented sufficient position tokens from returning to the protocol.

Investigations remain active while the protocol continues tracing funds and finalizes plans to compensate affected users.