Rhea Finance, a DeFi protocol on NEAR, said an attacker drained at least $7.6 million in an exploit tied to its margin trading system. The team said the weakness enabled a coordinated pool manipulation attack that affected ItLend, while the DEX was not impacted and rNEAR was not paused.
Fake token contracts and a new liquidity pool shaped the attack
Details first spread through posts on X. Based on the disclosures so far, the attacker created fake token contracts and added liquidity to a new pool, a setup that may have misled oracle feeds and basic validation checks. In its latest update, Rhea Finance said the flaw sat in Margin Trading and allowed the attacker to manipulate pool prices in a way that disrupted lending logic.
The public record describes an exploit, not a proven insider scam. The likely failure point was trust in price data coming from a newly created pool. If that data fed into lending markets, collateral values and risk checks could be distorted within seconds.
CertiK tracked addresses, Tether froze about $3.29M USDT
The response now involves several outside parties. CertiK said it flagged and tracked related addresses across Ethereum and NEAR. Tether CEO Paolo Ardoino later said the company froze roughly $3.29 million in USDT linked to the hacker.
Rhea Finance also sent an on-chain message to the responsible party and hired a security firm to handle forensics and asset tracing. Recovery remains the immediate focus, and on-chain wallet movements are likely to stay under close watch.
Tokenomics and product plans face fresh pressure
The exploit landed during the post-merger phase after Ref and Burrow joined in 2025. According to the project’s published tokenomics, 37% is allocated to REF and BRRR conversion, 30.6% to the airdrop and incentives, 11.8% to team and advisors, 8.6% to liquidity, and 6% each to marketing and treasury.
Its 2026 roadmap still lists a native Zcash Chrome wallet, a Meta DEX aggregator, cross-chain swaps, perpetuals access through Hyperliquid, and lending links with Aptos, Tron, Starknet, Polygon, and Plasma. For now, those plans are being overshadowed by questions around recovery and user protection.
RHEA trades near $0.01019 as reimbursement terms remain pending
Market data cited in the report showed the RHEA token at $0.01019, down 7.98%, with a market capitalization of about $2.03 million and trading volume of roughly $723,190.
The team said it is prioritizing user safeguards and recovery coordination. Both relevant contracts were paused to protect Lend, even though the DEX was not hit. A final reimbursement plan has not been published, and the size of any remaining shortfall depends on how much can be recovered through asset tracing, talks with the involved party, and work with law enforcement.