Slippage protection turns into a slippage trap, paying $18.4 million for a lesson: The security assumptions of DeFi must always be re-verified.

ME News message. On April 18 (UTC+8), 2026, the lending protocol RHEA Finance (formerly Burrow Finance) in the NEAR ecosystem was hacked, and approximately $18.4 million was stolen. The attacker planned the attack over several days by setting up multiple fake token pools on Ref Finance and injecting liquidity, exploiting a vulnerability in the protocol’s slippage protection mechanism. The borrowed debt tokens were routed to pools controlled by the attacker, resulting in large-scale forced liquidations and exhausting the protocol’s reserves. During the attack, the attacker deleted 55 intermediary accounts to conceal their identity. Currently, the RHEA lending contract has recovered approximately 3.359 million USDC and 1.564 million NEAR, with another 4.34 million USDT frozen, including