Rhea Finance lost $7.6 million on Thursday after attackers used a vulnerability in its Margin Trading feature to execute a pool manipulation attack on the Rhea Lend smart contract. CertiK reported the attacker created fake token contracts and added liquidity to fresh pools to mislead the oracle and validation layer. On the same day, the Kyrgyzstan-registered Grinex exchange halted withdrawals and trading after a cyberattack that drained approximately $15 million in USDT. Elliptic noted the stolen USDT was swapped into TRX and ETH to avoid being frozen by Tether.
These breaches are part of a wave of at least 12 attacks on DeFi protocols and crypto businesses since April 1, 2026. Other losses in April include $1.67 million from the Binance Smart Chain TMM/USDT liquidity pool, $423,000 from Aethir on April 9, $410,000 from Dango on April 13, and $392,000 from Silo Finance on April 3. The surge follows the $280 million exploit of Drift Protocol on April 1.
Investigators attribute the Drift exploit to the Democratic People’s Republic of Korea (DPRK), noting the attack began with a six-month social engineering operation where actors posed as a quantitative trading firm. Researchers highlight that DPRK-affiliated groups are now combining AI tools and social engineering to infiltrate companies and harvest credentials, bypassing traditional code audits. Elliptic has identified 18 DPRK-linked acts this year, with more than $300 million stolen so far.
