Rhea Finance Suffers $18.4 Million Exploit on NEAR Protocol, More Than Double Initial Estimates

Apr 18, 2026

Rhea Finance, a DeFi protocol operating on NEAR Protocol, suffered an $18.4 million exploit on April 16 through a sophisticated attack involving fake token contracts and deliberately constructed swap routes. Attackers created multiple fraudulent token contracts, added liquidity to newly created pools, and exploited vulnerabilities in Rhea Finance's oracle and validation layer to extract funds. The final damage assessment more than doubled initial estimates from blockchain security firm CertiK, which had reported at least $7.6 million in losses. The incident highlights ongoing security challenges facing DeFi protocols in the NEAR ecosystem.

Attack Mechanism and Fake Token Contracts

▪Rhea Finance is a DeFi protocol in the NEAR ecosystem.
▪Attackers created multiple fake token contracts in the Rhea Finance security incident on NEAR Protocol.
▪The fake token contracts are suspected of misleading Rhea Finance's oracle and validation layer.
▪Attackers added liquidity to newly created liquidity pools in the Rhea Finance exploit.

Financial Impact and Revised Loss Estimates

▪The Rhea Finance security incident occurred on April 16.
▪The Rhea Finance exploit losses were more than double the initial estimates.
▪CertiK monitoring initially estimated at least $7.6 million in assets were extracted from Rhea Finance pools.
▪Rhea Finance suffered an $18.4 million exploit according to the article headline.

Perspective of Rhea Finance

▪Rhea Finance's oracle and validation layer were suspected of being misled by fake token contracts during the April 16 exploit.
▪The Rhea Finance exploit involved deliberately constructed swap routes designed to bypass security measures.

Perspective of CertiK

▪CertiK's initial monitoring of the Rhea Finance exploit underestimated losses by more than half, reporting $7.6 million versus the actual $18.4 million.