NEAR Protocol

Ref Finance

DeFi

Oracle

World Liberty Financial

**Rhea Finance, the largest DeFi hub on NEAR Protocol<a href="https://yellow.com/asset/near" rel="noopener noreferrer nofollow">(NEAR)</a>, lost at least $7.6 million on Thursday after an attacker manipulated its oracle layer through fake token contracts.
<h2 id="rhea-finance-exploit">Rhea Finance Exploit</h2>
Blockchain security firm CertiK<a href="https://x.com/CertiKAlert/status/2044791732575912321" rel="noopener noreferrer nofollow">flagged</a> the breach and confirmed the scale of the losses. The stolen funds span several assets, including USDC<a href="https://yellow.com/asset/usdc" rel="noopener noreferrer nofollow">(USDC)</a>, USDT<a href="https://yellow.com/asset/usdt" rel="noopener noreferrer nofollow">(USDT)</a>, Zcash<a href="https://yellow.com/asset/zec" rel="noopener noreferrer nofollow">(ZEC)</a> and NEAR.
The attacker <a href="https://beincrypto.com/rhea-finance-near-exploit-oracle/" rel="noopener noreferrer nofollow">deployed</a> fake token contracts and then created fresh liquidity pools on the protocol, CertiK said.
Those pools appear to have distorted price feeds, tricking the oracle into approving fraudulent transactions. Rhea Finance has paused withdrawals while its team works to contain the damage.
Vadim Zacodil, a former NEAR core contributor, <a href="https://x.com/zacodil/status/2044801314903687328" rel="noopener noreferrer nofollow">confirmed</a> the figures on X and urged users to monitor the situation.
The attacker created fake token contracts and added liquidity in fresh pools, likely misleading the oracle and validation layer.
Also Read:<a href="https://yellow.com/news/world-liberty-financial-insider-token-burn" rel="noopener noreferrer nofollow">World Liberty Financial Demands Insiders Burn 10% Of Their WLFI Or Stay Locked</a>
<h2 id="near-defi-stakes">NEAR DeFi Stakes</h2>
Rhea Finance sits at the center of the NEAR ecosystem, which raises the stakes of the breach well beyond a single protocol.
It formed in early 2025 through the merger of Ref Finance and Burrow Finance, and it now runs as the chain's primary DEX and lending layer.
At its peak, the protocol held more than 95% of NEAR's DeFi total value locked, according to DefiLlama data. That concentration means an oracle failure here ripples across much of the network's on-chain activity.
Oracle manipulation has dogged DeFi for years, with attackers repeatedly targeting thin liquidity and untested price feeds to game valuations.
The October 2022 attack on Solana-based Mango Markets drained roughly $117 million after Avraham Eisenberg inflated the price of the platform's MNGO token. In April 2025, Binance-backed perpetuals exchange KiloEx lost about $7.5 million after an attacker exploited a custom price feed to set artificial entry and exit prices. The 2024 Polter Finance breach pulled out around $12 million after flash loans pushed up the value of the BOO token on SpookySwap, letting the attacker borrow far more than the collateral justified.
Read Next:<a href="https://yellow.com/news/binance-chat-crypto-transfers-feature" rel="noopener noreferrer nofollow">Binance Launches Built-In Chat Feature To Merge Messaging With Crypto Transfers</a>

NEAR's Biggest DeFi Protocol Rhea Finance Bleeds $7.6M In Fake-Token Oracle Attack

Table of Contents

Yellow News

Other articles published on Apr 16, 2026

Join our free newsletter for daily crypto updates!