**Rhea Finance, the largest DeFi hub on NEAR Protocol (NEAR), lost at least $7.6 million on Thursday after an attacker manipulated its oracle layer through fake token contracts.
Rhea Finance Exploit
Blockchain security firm CertiK flagged the breach and confirmed the scale of the losses. The stolen funds span several assets, including USDC (USDC), USDT (USDT), Zcash (ZEC) and NEAR.
The attacker deployed fake token contracts and then created fresh liquidity pools on the protocol, CertiK said.
Those pools appear to have distorted price feeds, tricking the oracle into approving fraudulent transactions. Rhea Finance has paused withdrawals while its team works to contain the damage.
Vadim Zacodil, a former NEAR core contributor, confirmed the figures on X and urged users to monitor the situation.
The attacker created fake token contracts and added liquidity in fresh pools, likely misleading the oracle and validation layer.
Also Read: World Liberty Financial Demands Insiders Burn 10% Of Their WLFI Or Stay Locked
NEAR DeFi Stakes
Rhea Finance sits at the center of the NEAR ecosystem, which raises the stakes of the breach well beyond a single protocol.
It formed in early 2025 through the merger of Ref Finance and Burrow Finance, and it now runs as the chain's primary DEX and lending layer.
At its peak, the protocol held more than 95% of NEAR's DeFi total value locked, according to DefiLlama data. That concentration means an oracle failure here ripples across much of the network's on-chain activity.
Oracle manipulation has dogged DeFi for years, with attackers repeatedly targeting thin liquidity and untested price feeds to game valuations.
The October 2022 attack on Solana-based Mango Markets drained roughly $117 million after Avraham Eisenberg inflated the price of the platform's MNGO token. In April 2025, Binance-backed perpetuals exchange KiloEx lost about $7.5 million after an attacker exploited a custom price feed to set artificial entry and exit prices. The 2024 Polter Finance breach pulled out around $12 million after flash loans pushed up the value of the BOO token on SpookySwap, letting the attacker borrow far more than the collateral justified.
Read Next: Binance Launches Built-In Chat Feature To Merge Messaging With Crypto Transfers