18.4 million dollars, 55 intermediary accounts completely deleted—this is not a hacker, it's practically on-chain agents.

ME News message: On April 18 (UTC+8), 2026, the lending protocol RHEA Finance (formerly Burrow Finance) in the NEAR ecosystem suffered a hack, with approximately $18.4 million stolen. The attacker planned it over multiple days by setting up multiple fake token pools on Ref Finance and injecting liquidity, exploiting a vulnerability in the protocol’s slippage protection mechanism. Borrowed debt tokens were then routed to pools controlled by the attacker, resulting in large-scale forced liquidations that depleted the protocol’s reserves. During the attack, the attacker deleted 55 intermediary accounts to conceal their identity. Currently, the RHEA lending contract has recovered about 3.359 million USDC and 1.564 million NEAR, and another 4.34 million USDT has been frozen, among other assets,