Incident case file
Sign in to watchRhea Finance — Fake Token Pool / Margin Trading Exploit (NEAR Protocol)
0 views
Estimated loss
Victims identified
Investigation
Facts and investigation
Attacker: 0xBb5Fa936469CaDb8907f3aEF80F5B53f55Bc11f6
Timeline: April 16, 2026 — CertiK Alert flags exploit; initial estimate $7.6M. Attacker deployed fake token contracts on NEAR and added liquidity to freshly created pools, tricking the margin parser into accepting fake collateral. Opened large number of undercollateralized margin positions → forced liquidations drained the reserve pool. Tether freezes $3.29M USDT same day. NEAR Intents co-founder sends on-chain message identifying the attacker. April 17 — First partial return: 3,495,342 USDC transferred back. Post-mortem revises total losses to $18.4M. 13,500 ZEC (~$4.5M) permanently lost in Zcash shielded pool.
Sources and coverage
- Articletheblock.cohttps://www.theblock.co/post/397961/rhea-finance-post-mortem-exploit-losses-18-4-million-double-initial-estimates
- Articlecryptotimes.iohttps://www.cryptotimes.io/2026/04/16/rhea-finance-loses-7-6m-in-exploit-says-certik/
- Articlecryptotimes.iohttps://www.cryptotimes.io/2026/04/18/hacker-returns-all-the-funds-to-rhea-finance-fact-check/
- Articlelivebitcoinnews.comhttps://www.livebitcoinnews.com/rhea-finance-exploit-7-6m-drained-via-fake-token-pools/
Victim testimonies
No testimonies yet.
+ Add my testimony → (coming soon)