Aurora

Shift

Partial

Surge

<ul>
 <li>Rhea Finance losses jump to $18.4M after exploit details emerge</li>
 <li>Attacker strategy used complex swaps to drain lending protocol reserves</li>
 <li>Partial fund recovery underway as investigators track remaining stolen assets</li>
</ul>
Rhea Finance has confirmed that losses from its recent exploit surged to $18.4 million after a deeper review. The revised figure more than doubles the earlier estimate of $7.6 million. This update shifts attention toward the attacker’s method, which relied on a carefully engineered trading strategy rather than a simple vulnerability. 
<h2 id="complex-swap-route-drives-coordinated-margin-exploit">Complex swap route drives coordinated margin exploit</h2>
<a href="https://x.com/CertiKAlert/status/2044791732575912321" rel="noopener noreferrer nofollow">According to the project’s post analysis</a>, the attacker constructed a complex swap route to manipulate margin trading positions. This approach allowed the attacker to borrow assets and redirect them into controlled liquidity pools. Consequently, the protocol received minimal value in return, which weakened collateral backing across multiple positions. 
Also Read: <a href="https://36crypto.com/bitcoin-miners-shift-to-ai-as-security-debate-intensifies-across-network/" rel="noopener noreferrer nofollow">Bitcoin Miners Shift to AI as Security Debate Intensifies Across Network</a> 
Moreover, this imbalance triggered a wave of liquidations that steadily drained the protocol’s reserves. Each liquidation cycle compounded the damage, as undercollateralized positions failed to recover sufficient value. As a result, the reserve pool absorbed significant losses while user funds faced exposure. 
Besides, the attacker repeated this process across numerous positions, which amplified the overall impact. This pattern suggests a deliberate and calculated strategy rather than an opportunistic breach. Hence, the unfolding details have drawn attention to how leverage features can become entry points for complex exploits. 
<h2 id="attacker-strategy-exposes-weaknesses-in-margin-trading-structure">Attacker strategy exposes weaknesses in margin trading structure</h2>
Further findings indicate that borrowed tokens moved into fake liquidity pools controlled by the attacker. Meanwhile, only negligible amounts returned to the protocol, which distorted internal accounting mechanisms. This imbalance allowed the attacker to sustain multiple undercollateralized positions without immediate detection. 
Additionally, automated liquidation systems reacted as designed but failed to prevent cumulative losses. The repeated triggering of these mechanisms ultimately depleted the reserve pool over several transaction cycles. Consequently, the exploit revealed structural weaknesses in how margin trading interacts with liquidity routing. 
<h2 id="recovery-efforts-gain-traction-as-investigators-track-remaining-funds">Recovery efforts gain traction as investigators track remaining funds</h2>
However, recovery efforts have made partial progress since the incident unfolded. The attacker returned 3.36 million USDC and 1.56 million NEAR, with a combined value near $3.5 million. At the same time, authorities froze approximately 4.34 million USDT, limiting further movement of funds. These actions followed confirmation from Tether CEO <a href="https://36crypto.com/paolo-ardoino-early-life-and-net-worth-the-vision-behind-tether-and-the-crypto-world/" rel="noopener noreferrer nofollow">Paolo Ardoino</a>. 
Rhea Finance has paused affected contracts and continues to collaborate with exchanges and investigators. The team is tracking about $5.6 million that remains unaccounted for. Additionally, Aurora Labs co founder Alex Shevchenko sent an onchain warning, stating that associated accounts have been identified and urging the return of remaining assets. 
The protocol is also preparing a compensation framework to address user losses, although specific details remain undisclosed. This step reflects ongoing efforts to stabilize operations and restore confidence among participants. 
Rhea Finance now faces increasing pressure as details of the attacker’s strategy continue to emerge. The incident underscores growing risks in leveraged DeFi systems while recovery efforts remain underway. 
Also Read: <a href="https://36crypto.com/hyperliquid-surge-sparks-150-hype-prediction-after-hayes-bold-move/" rel="noopener noreferrer nofollow">Hyperliquid Surge Sparks $150 HYPE Prediction After Hayes Bold Move</a> 
The post <a href="https://36crypto.com/rhea-finance-hack-explodes-to-18-4m-as-attacker-strategy-unravels/" rel="noopener noreferrer nofollow">Rhea Finance Hack Explodes to $18.4M as Attacker Strategy Unravels</a> appeared first on <a href="https://36crypto.com" rel="noopener noreferrer nofollow">36Crypto</a>.

Rhea Finance Hack Explodes to $18.4M as Attacker Strategy Unravels

Table of Contents

36crypto

Other articles published on Apr 18, 2026

Join our free newsletter for daily crypto updates!