Rhea Finance Exploit Drains $7.6 Million and Freezes Assets of 95% of NEAR DeFi Users

Users of Rhea Finance can no longer withdraw their assets. The protocol halted withdrawals to contain damage after an attacker extracted $7.6 million in USDC, USDT, Zcash, and NEAR. The exploit occurred when an attacker deployed fake token contracts and created fresh liquidity pools. These pools distorted price feeds, which misled the oracle and validation layer into validating fraudulent transactions. The attacker bypassed traditional security failures like private key compromises, targeting instead the trust-based logic of the protocol's validation process. Rhea Finance is the primary DEX and lending layer on the NEAR Protocol, and previously held over 95% of the network's DeFi total value locked. Tether froze $3.29 million in USDT tied to the attacker, but $4.31 million remains unrecovered.