Rhea Finance (Rhea Lend on NEAR) loses about US$18.4 million through margin flaw; most funds returned or frozen
Rhea Lend on NEAR lost about US$18.4M on 16 April 2026 when an attacker beat its margin trading slippage check. Much was returned or frozen, and Rhea says it will cover the roughly US$0.4M gap. Margin trading is discontinued. Whether lending reopened is unconfirmed.
Nothing for you to do unless you lent or deposited funds in Rhea Lend. If you did, check Rhea Finance's official channels for the compensation and withdrawal process, and be wary of unsolicited messages offering to recover your funds.
What’s happening
On 16 April 2026, Rhea Lend, the lending service of Rhea Finance on the NEAR blockchain, was drained of about US$18.4 million. Early alerts said US$7.6 million. Rhea's post-mortem the next day raised the figure. The attacker had spent 13 to 15 April creating fake tokens and eight pools on the Ref Finance exchange. They then used a deliberately built chain of swaps to get past the slippage check in Rhea's margin trading feature. The check added up the minimum expected output of every swap step, so it was fooled. Positions opened with far less value than their debt, and the resulting liquidations emptied the reserve pool. Rhea paused its contracts. The attacker returned about 3.36 million USDC and 1.56 million NEAR, and Tether and NEAR Intents froze about 4.34 million USDT. Later reports describe about 13,500 ZEC returned and a remaining gap of about US$0.4 million, which Rhea says it will cover. Rekt News reported some funds went into Zcash shielded pools. The sources' recovery figures do not fully reconcile. Margin trading on NEAR was permanently discontinued. A phased lending reopening was targeted for early May 2026, but I found no source confirming it happened. No arrests or charges were reported.
- What
- Breach
- Affects
- Rhea Finance's Rhea Lend (NEAR blockchain lending and margin trading)
- Fixed in
- Nothing to patch
- Since
- 16 Apr 2026
- Closed
- 22 Apr 2026
Timeline
- UpdateNothing to patch
A second incident report, as summarised by QuillAudits, listed about 13,500 ZEC returned and USDT frozen both in the attacker's wallet and in NEAR Intents, with a remaining shortfall of about US$0.4 million that Rhea committed to cover. It said margin trading on NEAR was permanently discontinued and a phased lending reopening was targeted for early May 2026.
- UpdateNothing to patch
Rekt News reported the attacker prepared from 13 to 15 April with fake tokens and Ref Finance pools. It said part of the funds went to Ethereum and into Zcash shielded pools, which it called unrecoverable. It noted its recovery figures did not fully reconcile.
- Vendor revisedNothing to patch
Rhea's post-mortem raised the loss to about US$18.4 million. It said a deliberately built swap route defeated slippage protection and left positions undercollateralised, which depleted the reserve pool. The attacker had returned about 3.36 million USDC and 1.56 million NEAR, and about 4.34 million USDT was frozen, bringing returned and frozen funds to roughly US$11.2 million.
- Made publicNothing to patch
Rhea Finance's Rhea Lend on NEAR was drained through its margin trading feature. CertiK's first alert put the loss at about US$7.6 million, and Rhea paused its contracts.
Sources
- Rhea Finance post-mortem puts exploit losses at $18.4 million, more than double initial estimatesThe Block · 17 Apr 2026
- Rhea Finance revises exploit losses to $18.4M, confirms slippage flaw as funds partially recoveredAMBCrypto · 17 Apr 2026
- Rhea Finance $18.4M Slippage Exploit (Explained)QuillAudits · 22 Apr 2026
- Rhea Finance - Rekt NewsRekt News · 21 Apr 2026