Rhea Finance said an exploit drained approximately $18.4 million from its lending protocol on Thursday, more than doubling early estimates that had pegged losses at around $7.6 million.
The updated figure comes from a post-mortem published Friday, where the Rhea team shared more details of the attack that targeted the protocol’s margin trading feature.
Using what the team described as a “deliberately constructed swap route,” the attacker opened a large number of margin trading positions.
“Borrowed debt tokens were funneled into the attacker’s fake token pools, while only a negligible amount of position tokens were returned to the protocol,” the report said. Positions were then left undercollateralized, triggering liquidations that “resulted in the depletion of the protocol’s reserve pool.”
Rhea said the exploit resulted in “realised losses within the protocol,” affecting reserves and users.
A large portion of the funds has since been recovered or frozen. The attacker returned roughly 3.36 million USDC and 1.56 million NEAR (worth roughly $3.5 million) to the protocol, while about 4.34 million USDT has been frozen, according to the team and confirmed by Tether CEO Paolo Ardoino.
The protocol paused affected contracts and claims to be working with exchanges and investigators to trace the outstanding token value of around $5.6 million. The team said a compensation and recovery framework is in the works, but gave no specific details as to what that might look like.
Aurora Labs and Near Intents co-founder Alex Shevchenko sent the attacker an onchain message warning the sender that they had “identified you and your associated accounts” and called for the return of the rest of the assets.
Disclaimer: The Block is an independent media outlet that delivers news, research, and data. As of November 2023, Foresight Ventures is a majority investor of The Block. Foresight Ventures invests in other companies in the crypto space. Crypto exchange Bitget is an anchor LP for Foresight Ventures. The Block continues to operate independently to deliver objective, impactful, and timely information about the crypto industry. Here are our current financial disclosures.
© 2026 The Block. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.
