Rhea Finance, the largest decentralized finance (DeFi) protocol built on the NEAR Protocol, was recently hit by an Oracle manipulation attack, The Block reported. A subsequent post-mortem analysis released afterward shows actual losses of $18.4 million, more than twice the initial estimate.
Attack method: Fake token manipulation of Oracle pricing
According to the investigation, the attacker manipulated Rhea Finance’s Oracle price by deploying a fake token contract, causing the protocol to incorrectly assess the collateral value and then drain liquidity. After the incident, the Rhea Finance team immediately notified users and paused the relevant functions to launch an emergency response.
ZachXBT raises the alert; Tether freezes $4.34 million USDT
Blockchain sleuth ZachXBT quickly issued an alert after the incident, tracking the flow of attack funds and prompting Tether to take action. Tether CEO Paolo Ardoino publicly thanked ZachXBT for the timely report, confirming that it has frozen roughly $4.34 million in USDT (another figure is $3.29 million) and funds related to the attacker, preventing the stolen funds from being transferred any further.
The attacker returns part of the funds
Notably, the attacker has proactively returned about $3.36 million worth of USDC and $1.56 million worth of NEAR (totaling about $3.5 million) to the protocol. Combined with the frozen USDT, the total funds that have been recovered or frozen now exceed $7.8 million, accounting for about 42% of the total loss.
NEAR DeFi ecosystem’s biggest security incident
Rhea Finance is the largest DeFi protocol on the NEAR Protocol. This incident is one of the most severe security incidents to date in the NEAR ecosystem, and it once again highlights the core importance of Oracle security to DeFi protocols. The event also sparked widespread discussion in the market about potential design flaws in DeFi protocol Oracles; the price of the RHEA token fell by more than 8% at one point after the incident.
This article, Rhea Finance suffers $18.4 million loss from an Oracle attack: ZachXBT raises an alert, Tether freezes $4.34 million USDT; the attacker returns part of the funds, first appeared on Chain News ABMedia.
