RHEA Finance Suffers $18.4 Million Loss in Hack

RHEA Finance, a lending protocol within the NEAR ecosystem, has experienced a significant security breach resulting in a loss of approximately $18.4 million. According to ChainCatcher, the attack exploited vulnerabilities in the protocol's margin trading feature. The attacker prepared for the breach days in advance by creating multiple fake token pools on Ref Finance and injecting liquidity to construct malicious swap routes. The exploit targeted a flaw in the protocol's slippage protection mechanism, which failed to account for the repeated use of intermediate tokens during multi-step swaps. This oversight allowed the borrowed debt tokens to be redirected into fake token pools controlled by the attacker, triggering large-scale forced liquidations and depleting the protocol's reserve pool. During the attack, the perpetrator deleted 55 intermediary accounts to conceal their activities. In response, the attacker has returned approximately 3.359 million USDC and 1.564 million NEAR to the RHEA lending contract. Additionally, 4.34 million USDT has been frozen, with Tether freezing 3.291 million and NEAR Intents freezing 1.053 million. The protocol's contract operations have been suspended, and the team is collaborating with centralized exchanges to track the attacker. Relevant law enforcement agencies have been notified as part of the ongoing investigation.