The security model of the lending protocol needs to be rewritten — when an attacker can manipulate the pricing power of the liquidity pool, the liquidation mechanism becomes a scythe instead.

On April 18th, the NEAR ecosystem lending platform RHEA Finance was hacked, resulting in the theft of approximately $18.4 million. The attacker set up a fake token pool on Ref Finance and injected liquidity, exploiting a slippage vulnerability to direct borrowed debt tokens to a control pool, leading to mass liquidations and depletion of reserves. To conceal their identity, they deleted 55 intermediary accounts. Currently, they have recovered 3.36M USDC, 1.56M NEAR, and frozen 4.34 million USDT (Tether 3.29M, NEAR Intents 1.05M). The protocol has been paused, and authorities are cooperating with exchanges and filing a report.