How a Fake Token Maze Drained $18.4 Million From Rhea Finance's Margin Engine

An attacker spent roughly 42 hours preparing a swarm of 123 worthless tokens and five worker wallets before launching them within ten seconds of one another, and by the time most users had noticed anything was wrong, $18.4 million had left the largest DeFi protocol on NEAR.

Rhea Finance, the platform created by the 2025 merger of Ref Finance and Burrow Finance and which at one point controlled more than 95% of NEAR's total DeFi liquidity, didn't fall to a sophisticated economic exploit or a stolen key. It fell because its margin-trading system trusted liquidity pools it had never verified.

At the center of the breach was a flaw in Rhea's margin trading engine: a validation routine that accepted a synthetic swap route as genuine, released real assets against it as collateral, and never confirmed that the tokens returned by the swap actually matched what it had approved moments earlier.

The attacker built the entire environment first — deploying their own token contracts, minting supply out of thin air, and seeding matching liquidity pools. Rhea's pricing logic treated every one of those fabricated signals as legitimate market data, and on that basis it released genuine USDC, USDT, ZEC, and NEAR against collateral that had no real value at all.

What set this incident apart from comparable exploits wasn't the mechanism — it was the exit strategy.

Rhea had spent months developing a Zcash integration central to its "ZcashFi" positioning, including a $54,200 grant application submitted just three weeks before the attack. The attacker used that very infrastructure to funnel roughly $4 million into Zcash's shielded pool, where zk-SNARK-based privacy makes on-chain tracing effectively impossible. The feature Rhea had been showcasing as its next big product became the attacker's preferred exit.

Tether froze $3.29 million of the stolen funds, and Near Intents intercepted roughly another $3.3 million mid-withdrawal. But approximately $4 million in ZEC is gone for good — not because the attacker was lucky or fast, but because the privacy guarantees Rhea had been marketing performed exactly as designed for someone who was never supposed to benefit from them.

01Timeline: From First Alert to Official Numbers

CertiK Alert was first to publicly flag the incident, early on April 16, reporting: "We have seen an incident affecting Rhea Finance. The attacker created fake token contracts and added liquidity in fresh pools, likely misleading the oracle and validation layer. In total, at least ~$7.6M was extracted." That early estimate, tied to a single wallet address, would eventually prove to be less than half of the true total.

Attacker/collector NEAR wallet: 31ac7a2705a0686ff427b1a52d3ffd1fcfaa4b1f3cb3e83a0f767494e724a540

Rhea's own first statement came several hours later, after the attacker had already completed the operation: "The RHEA team is aware of an incident affecting the protocol. As a precautionary measure, we have temporarily paused the contracts while we conduct a thorough investigation." The message was short, gave no dollar figure, named no affected contracts, and offered no sense of scale. Notably, the team had already contacted the attacker on-chain before this public statement went out.

On-chain outreach transaction: 6r5c2iZighKJRcjXLkBbhQJxZ5dmzKTZDnqT7cmd8gh6

Tether had already acted by the time Rhea published that first tweet. Paolo Ardoino, Tether's CEO, confirmed on X that $3.29 million in USDT tied to the attacker's wallet had been frozen before it could be moved or converted, adding simply: "Tether cares." That freeze was only possible because those particular USDT holdings hadn't yet been touched — funds the attacker had already converted to USDC, specifically to sidestep this kind of intervention, were already unrecoverable through that channel.

That USDT-to-USDC conversion was flagged by independent analysts in the ETH Security Telegram channel before any formal security firm had published a report, and their own running estimate of total losses was already closer to $20 million — well above the $7.6 million figure circulating at the time. They also offered assistance tracing the NEAR-side fund flows.

On April 17, Rhea published a fuller update that, for the first time, identified the underlying cause: "Based on a preliminary analysis, the attacker leveraged a vulnerability in Rhea's Margin Trading feature to execute a coordinated pool manipulation attack." The same update clarified that Rhea Lend was affected and paused, Rhea DEX was unaffected but paused as a precaution, and rNEAR was untouched and remained live. The team also said it was in contact with the party responsible about returning remaining funds, had brought in a "leading security team" for forensic analysis, and had alerted law enforcement — though it still offered no total loss figure, no reimbursement plan, and no post-mortem.

That same day, QuillAudits published the most granular forensic breakdown to date: roughly $18.6 million stolen across 1,142 transactions, using 123 fake tokens and five worker wallets, following 42 hours of preparation before the first dollar moved. Rhea's own official figure would eventually settle at $18.4 million.

02Inside the Exploit: A Parser That Miscounted

The vulnerability wasn't in Pyth, and it wasn't in the Ref Finance DEX itself. It lived inside Burrowland's margin-position-opening validation logic — specifically, a route-parsing function that tallied the wrong values and then failed to verify that the swap's actual output matched what had just been approved.

Understanding the exploit requires looking at what the attacker built before ever touching Rhea Lend. Preparation began as early as April 13. Several accounts inside Rhea's Multichain Account system — including rhea000453.multica.near, rhea000462.multica.near, and rhea000505.multica.near — became active around this time and later received funds traceable back to the attacker's wallet.

The core attacker wallet was created on April 15 via a minimal "dust" NEAR transfer, was funded through intents.near within five minutes, and then rapidly distributed capital to dozens of intermediary accounts in an automated sequence. On the morning of April 16, multiple fake fungible-token contracts were deployed on NEAR.

Shared code hash across the fake token contracts (per forensic analysis): BBeoVgxZC5Ce1ef7nErevX98QonNsedBFfqzep5RV1Vu

All four contracts lacked standard NEP-141 metadata methods, confirming they were built purely for price manipulation rather than as functioning tokens.

Fake token contracts: c122aad2a188ed3abec0517f99c4dd03591d19e6bfcf7f015424351fbdd71163 · 7d06ad005e03aa875875481fb6a2bd1acf9e722100ab8747e4e97801ba340640 · 9c0df321dd5d9fc1138a09f405f523333fffe74de2ee10932ff756e27ae930ee · 80f357d92e67f0ea53f299bb16d3af363ba0ef66e0211091edc2181cd323a705

Around those tokens, the attacker constructed a consecutive block of 25 liquidity pools on Ref Finance, numbered 8514 through 8538, arranged in deliberate layers: ZEC paired against the initial fake tokens, fake-token-to-fake-token pools, and fake-token-to-USDC pools. This wasn't an arbitrary pool graph — it was engineered so that a multi-hop swap route would repeatedly pass through USDC as an intermediate step, only to swap it away again on the following hop. That structure was the actual weapon.

Here's the mechanism: when a worker account opened a margin position via Burrowland using a Ref V1-style swap instruction, Burrowland's get_token_out() function parsed the proposed route to determine the minimum acceptable position size — min_token_p_amount — the trade needed to produce. Burrowland's slippage-protection logic added up every min_amount_out value across each step of the swap, but it never accounted for cases where a token output at one step gets reused as the input to the next.

Because the attacker's route bounced through USDC repeatedly as an intermediate hop — zec.omft.near → fake token → fake token → USDC → fake token → USDC → ... → fake token → USDC — every one of those USDC legs carried its own min_amount_out value, and all of them were added together rather than isolated to the final output. The function never separated the true terminal output from the intermediate ones — a mechanism Rhea's own incident report later confirmed.

The result was a minimum position size wildly inflated beyond anything the route could legitimately return. Burrowland then passed that inflated number into its Pyth-backed sanity check, is_min_amount_out_reasonable(), which compares the figure against real oracle-priced values for the endpoint assets. Because the route had been deliberately engineered to make that inflated minimum pass the check, validation succeeded, and Burrowland emitted margin_open_started and forwarded the swap to Ref.

Ref executed the route exactly as instructed. The genuine USDC returned to Burrowland at the end of the chain came to 7,925 smallest units — against a previously validated minimum of 32,595,520,035,000,000,000,000. That's a discrepancy of more than 4.1 million times.

Sample worker transaction opening a poisoned margin position: 4H5kQ4HNWX4cqdksbwarbwmVZYVwRub25eWT2k97r1AN

When Ref's actual output came back, Burrowland's on_open_trade_return() simply credited whatever arrived, with no comparison against the previously validated minimum, no repeated health-factor calculation, and no leverage check. The system only reverses a margin operation when the swap fails outright — that is, when amount_in_used equals zero. Receiving a tiny fraction of the validated amount didn't register as a failure; it registered as a success, a point Rhea's own incident report corroborates. Burrowland then emitted margin_open_succeeded: a position opened, and real assets borrowed against collateral that was effectively worthless.

Because each opened position was worth far less than the debt attached to it, forced liquidations kicked in immediately, and that liquidation cascade drained the protocol's own reserve pool, amplifying the losses well past the initial borrowed amount. Once positions were open, the attacker also pulled liquidity back out of the fake pools, reclaiming the genuine assets originally used to seed them.

Each of the five worker accounts followed the identical sequence independently: deploy pools, seed liquidity, receive collateral from the master account, deposit into Burrow, open the poisoned margin position, withdraw, pull liquidity from the fake pools, and transfer USDC and ZEC back to the master account.

Worker accounts: d4e8e706f5a59610d85924af858f0562031930d14eb7add9a433edea50cf0b03 · d39fd6da5eda882fe5f6716212552356cde2613054c670ffd6b49b3b25aef473 · 839810a1aef8ed1adb03e795b2a9785d783d4e2f415ab80c8b6fb30483e160f2 · 9053223460198e5e1e54dc15c18295ff0e98dca41ecd6c3872da1ff634d99616 · 5a7695e3626aeae7c0d340b6e58f813c71455d1be490eeb44e90bd9682343040

The fake pools therefore served two purposes at once: they created the route structure needed to inflate the validated minimum, and — once the position was open and assets borrowed — they let the workers withdraw liquidity and recover the genuine USDC and ZEC used to seed them in the first place.

Master account: 72633832db9d039b97906320169a8411bc2fa0f78303a4ecb1d35de71af621c5

Collector account: 31ac7a2705a0686ff427b1a52d3ffd1fcfaa4b1f3cb3e83a0f767494e724a540

At its core, the failure was Burrowland treating intermediate route minimums as if they were final settlement guarantees, and then accepting whatever Ref actually returned without ever checking whether the two figures should have matched.

03Following the Money

Once positions were open and assets extracted, the operation shifted from exploitation to extraction, and the chain recorded every step. Workers withdrew the real USDC and ZEC from Ref Finance and routed it to the master account in parallel batches — roughly 109.54 ZEC and 7,661 USDC per worker, with supplementary ephemeral accounts moving chunks of about 10,583 USDC and 10,578 USDT. The consistency of those batch sizes points to a scripted extraction pipeline rather than organic trading behavior.

The master account then consolidated everything and forwarded it to the collector, with confirmed transfers of:

• 1,700,000 NEAR — AJ42stVaKFsU2xYVZxzKFVRHvraeWgeEWxym7orJiGEY
• 460,455 USDC — CXEnUrkeACi96BTNMJTbq4umK1EGFhnTfqJpieBMUd8F
• 446,582 USDT — CHmaMXtnXrU9mBe3GYPPnGMMPT8ziKaJien9vdJ8VkPZ
• 799,903 wNEAR — HuFrgaNEbvxZAgGBKD2k9VGfBaBhSYXjJhp632qAHhaW
• 7,095 ZEC — 6NyvczzGBdEDZtxsT7XYxcGD2fdSZcVrWdGX7sS1PE1p

From the collector account, the entire $18.4 million basket moved through NEAR Intents in three steps: internal transfer intents spread the funds across sibling wallets, ft_withdraw calls brought real USDC back onto NEAR, and ft_withdraw calls on zec.omft.near sent ZEC directly into Zcash Unified Addresses — the fully shielded pool.

That final move was planned, not improvised. Knowing Tether's freeze capability, the attacker swapped USDT to USDC mid-operation, before routing anything through Intents, as a deliberate countermeasure. The USDT that wasn't converted in time was frozen; the USDC that had already been swapped was gone. In total, $3.29 million USDT was frozen by Tether directly in the attacker's wallet, with an additional $1.05 million frozen within NEAR Intents — $4.34 million in frozen USDT combined.

Roughly $5.5 million in USDC and NEAR was recovered when Near Intents froze the attacker's account mid-withdrawal. Separately, about $4 million in ZEC — 12,095 coins — reached Zcash's shielded pools and is considered unrecoverable.

The remaining $3.4 million in USDC didn't stay on NEAR: it bridged to Ethereum, arrived at the attacker's ETH address, and was deposited into Aave as aUSDC.

Attacker ETH wallet: 0xbb5fa936469cadb8907f3aef80f5b53f55bc11f6

That Aave position is fully traceable, and Circle retains the technical ability to blacklist the USDC involved — whether it chooses to is a separate matter.

Later the same day, the collector sent approximately 1,564,704 NEAR back to contract.main.burrow.near.

Collector-to-Burrow transfer: Fe4JXLSq8iBJFTVRvo6ye48G8JGofuG5xfwUgfn55Yca

Rhea's official incident report confirms the attacker has since returned approximately 3.359 million USDC and 1.564 million NEAR to the RHEA lending contract, and additional assets have been returned beyond those initial figures. The lending contract remains frozen to safeguard those recovered funds while the investigation continues.

Taken together, the current accounting looks like this: approximately $5.5 million returned or recovered via the Intents freeze and mid-cashout intervention; about $4.34 million in USDT frozen ($3.29 million by Tether in the attacker's wallet, $1.05 million within NEAR Intents); roughly $3.4 million in USDC sitting as aUSDC on Aave Ethereum, traceable but not yet blacklisted; and approximately $4 million in ZEC inside Zcash's shielded pools, considered gone. The remainder is still being traced across Intents solver outflows.

Rhea says it remains in contact with the attacker regarding the return of remaining funds and has notified law enforcement. But notifying authorities is the straightforward part — roughly $4 million of the stolen funds was, by design, always going to end up somewhere untraceable, funneled through infrastructure Rhea itself had spent months building, actively promoting, and pitching to the Zcash community for grant money only three weeks earlier.

04A Familiar Pattern Across DeFi

This kind of attack has precedent stretching back years. In Mango Markets, October 2022, Avraham Eisenberg pushed up the price of MNGO using thin liquidity, borrowed against the artificially inflated collateral, and extracted roughly $110 million, later describing it as a "successful and legal trading strategy." A jury convicted him of fraud and market manipulation in April 2024, though a federal judge subsequently overturned those convictions. The core mechanics — manufacture a price signal, borrow real value against it, exit before detection — mirror what happened at Rhea, just at a different scale.

More recently, KiloEx lost about $7.5 million in April 2025 when an attacker exploited a custom price feed to dictate artificial entry and exit prices, with no circuit breakers or minimum-liquidity safeguards in place. Makina Finance lost roughly $4.1 million in January 2026 through a permissionless AUM update function that pulled spot prices from Curve pools that could be manipulated — despite six prior audits, one gap slipped through, and the exact attack vector had reportedly been marked out of scope by Cantina three months earlier. In YieldBlox, February 2026, an attacker borrowed roughly $10.97 million against USTRY collateral that had been pumped 100x in a single trade in a market with under a dollar of hourly volume; the Reflector oracle simply reported what that thin market showed, with nobody questioning whether the market itself was trustworthy.

Rhea Finance, April 2026, adds roughly $18.4 million to that list, via a margin validation function that summed intermediate route minimums as though they were final guarantees. Each incident is technically distinct, but the underlying pattern repeats: a permissionless surface — a DEX, a price feed, an oracle, a liquidity pool — gets treated as trusted input by a lending or margin system with no way to verify whether that input reflects actual market reality. Attackers find the gap between what a system validates and what it actually receives, and everything downstream executes exactly as coded.

What distinguishes Rhea from this list isn't the structural flaw — that gap between trusted input and reality was the same. What sets it apart is the operational sophistication behind it: three full rehearsal cycles the day before the attack, 123 fake token contracts, five worker wallets launched within ten seconds of each other, and a deliberate mid-operation stablecoin swap specifically designed to defeat Tether's freeze capability. The shielded ZEC exit ran through infrastructure the protocol had built and was actively promoting to the Zcash community at the time. This wasn't someone who stumbled onto a pricing quirk; it was a planned operation with contingencies built in for the most likely countermeasures.

For context, one community member's reply to the initial CertiK alert read: "Panic is inappropriate. The hacker won't be able to withdraw coins from their wallet; this feature is disabled. That's the difference between near eco and other landings like drift or resolve." That comment was posted before the ZEC exit was confirmed, before it was known that 12,095 ZEC had already cleared the shielded pool, before the Ethereum Aave position had been identified, and before the USDT-to-USDC swap was understood for what it was.

Chainalysis reported that crypto theft reached $3.4 billion in 2025, among the worst years on record. Given that 95% of NEAR's DeFi TVL sat inside a single protocol, this incident's impact extends well beyond Rhea itself — it affected the broader NEAR ecosystem.

05Security Infrastructure That Didn't Cover the Gap

Rhea wasn't operating without any security tooling, which makes the outstanding questions more pointed. In August 2025, Rhea announced Pyth Network as an official oracle partner, supplying real-time price feeds across its product line — framed at the time as institutional-grade infrastructure that would set it apart from protocols pricing collateral off thin, self-hosted liquidity. Yet Rhea's post-incident statements confirmed the vulnerability sat in the Margin Trading feature, and the team has not explained why that feature wasn't relying on the same Pyth integration announced the previous year. No complete post-mortem has been published as of this writing.

The Zcash timeline adds another dimension. Roughly three weeks before the exploit, Rhea submitted a $54,200 application to the Zcash community for the "Rhea Zcash Gateway" — a browser-based wallet and cross-chain DeFi integration for ZEC, described as enabling lending, borrowing, and liquidity access while preserving Zcash's privacy properties. The integration was new and was being actively promoted through public roadmap posts and grant applications. The withdrawal path the attacker used — zec.omft.near — runs on NEAR Intents, the same cross-chain infrastructure underpinning Rhea's ZEC integration. That grant application was formally approved just three days before the attack. The ZEC integration wasn't itself the vulnerability — it was the exit route for roughly $4 million that investigators cannot follow.

On the audit history: Burrowland underwent two BlockSec audits before its March 2022 mainnet launch, which identified and fixed seven mid-to-low risk issues. Margin trading itself arrived as a V2 feature in July 2024, more than two years after those original audits concluded. To whatever extent later review touched the V2 margin code, it appears to have confirmed the code behaved as written — both get_token_out() and on_open_trade_return() executed exactly as designed. What apparently wasn't tested was whether a route could be constructed to make that counting catastrophically wrong, or whether settling for whatever the swap actually returned — without re-checking it against the validated minimum — left a gap wide enough to drive $18.4 million through.

Rhea had a Pyth partnership. It had a 2026 roadmap full of cross-chain ambitions and a freshly submitted grant application describing its ZEC infrastructure as a flagship offering. None of that reached the margin parser, and nothing enforced the basic requirement that what a swap route promised to deliver match what the protocol actually needed to receive.

06Where Things Stand

Rhea has engaged outside security firms, notified law enforcement, and says it remains in communication with the party responsible about returning the rest of the funds. The attacker has already returned approximately 3.359 million USDC and 1.564 million NEAR to the lending contract, with further assets returned since. Rhea has said it intends to draw on its protocol reserve fund and team operational resources as part of a compensation framework, though the details and scope are still being worked out. A full recovery plan, asset breakdown, and user-support framework has been promised but not yet published. Rhea DEX on NEAR is expected to reopen gradually once all contracts have been reviewed and hardened.

Several questions remain unanswered: why the Margin Trading feature wasn't built on the same Pyth infrastructure used elsewhere in the protocol, whether the route parser was ever tested against adversarial inputs, and who — if anyone — stress-tested the ZEC withdrawal path before it launched. No complete post-mortem has been released to date.

In the end, the code executed precisely as written, the protocol accepted whatever came back from the swap, and nothing in between checked whether those two outcomes were supposed to be the same thing.