The Architecture
Rhea Finance sits at the center of the NEAR Protocol ecosystem, and on February 17, 2026, that centrality became a catastrophic liability. The protocol lost at least $7.6 million after an attacker manipulated its oracle layer through a series of fake token contracts, draining USDC, USDT, Zcash (ZEC), and NEAR tokens from its liquidity pools before the team could respond.
Rhea Finance formed in early 2025 through the merger of Ref Finance and Burrow Finance, consolidating NEAR’s two most prominent DeFi primitives — a decentralized exchange and a lending platform — into a single protocol. At its peak, Rhea held more than 95% of NEAR’s total DeFi value locked, according to DefiLlama data. That concentration, which once looked like a competitive advantage, instead became the vector for the network’s most damaging exploit to date.
The attack architecture followed a well-established playbook. The attacker deployed counterfeit token contracts and created fresh liquidity pools on the protocol. These fake pools distorted the price feeds that Rhea’s oracle relied upon, tricking the validation layer into approving fraudulent transactions at manipulated valuations.
Consensus Mechanisms
NEAR Protocol uses a proof-of-stake consensus mechanism called Nightshade, which shards the network into multiple parallel chains to improve throughput. While this architecture delivers impressive transaction speeds and low fees, it introduces unique challenges for DeFi security. The sharded structure means that oracle data must propagate across multiple shards, creating potential latency windows that attackers can exploit.
In the Rhea Finance attack, the oracle manipulation appears to have exploited a validation gap between when the fake token contracts were deployed and when the oracle layer could verify the legitimacy of the new pools. Blockchain security firm CertiK, which first flagged the breach, confirmed that the stolen funds spanned multiple asset types — a hallmark of attacks that compromise core protocol infrastructure rather than individual pool vulnerabilities.
Vadim Zacodil, a former NEAR core contributor, confirmed the $7.6 million figure publicly and urged users to monitor the situation. Rhea Finance paused withdrawals while its team worked to contain the damage, but for a protocol holding over 95% of a network’s DeFi TVL, a pause is effectively a network-wide liquidity freeze.
Network Health
The timing of the attack could not have been worse for NEAR Protocol’s market position. With the broader crypto market already in a risk-off mode — Bitcoin at $67,494, down nearly 2% on the day, and Ethereum at $1,992 struggling below the psychological $2,000 level — investor confidence in alt-ecosystems was already fragile. The Rhea Finance exploit has amplified concerns about whether NEAR’s DeFi ecosystem has sufficient redundancy to withstand attacks on its dominant protocol.
The concentration risk is the core issue. When a single protocol controls more than 95% of a network’s DeFi activity, that protocol’s security becomes the network’s security. A failure in Rhea’s oracle layer is not an isolated incident — it is a systemic event that affects every user, liquidity provider, and derivative protocol in the NEAR ecosystem.
Historical parallels are instructive. The October 2022 Mango Markets attack drained $117 million from Solana’s DeFi ecosystem after Avraham Eisenberg inflated the MNGO token price. In April 2025, KiloEx lost $7.5 million through a custom price feed exploit. The 2024 Polter Finance breach extracted $12 million using flash loan-driven oracle manipulation on SpookySwap. Each of these cases followed the same pattern: oracle manipulation exploiting thin liquidity or inadequate price feed validation.
Developer Ecosystem
The Rhea Finance exploit raises pressing questions about the depth of NEAR’s developer ecosystem. A healthy DeFi landscape requires multiple competing protocols that provide redundancy and force each other to maintain higher security standards. When one protocol dominates overwhelmingly, the competitive pressure that drives security investment diminishes, and the single point of failure risk compounds.
NEAR’s developer community now faces a critical inflection point. The protocol can either treat the Rhea Finance exploit as an isolated incident and rebuild, or it can use the event as a catalyst for structural reform — incentivizing new DeFi protocols, implementing network-level oracle standards, and establishing ecosystem-wide security practices that reduce concentration risk.
The response from NEAR’s core team and the broader community in the coming weeks will signal whether the network is committed to building a resilient multi-protocol DeFi ecosystem or is content to remain dependent on a single point of failure. For a blockchain that has positioned itself as a high-performance platform for decentralized applications, the stakes extend well beyond the $7.6 million lost in this single attack.
Final Assessment
The Rhea Finance oracle attack is a textbook case of concentration risk materializing in real time. The $7.6 million loss is significant but recoverable. The real damage is to confidence in NEAR’s DeFi ecosystem and the broader lesson about the dangers of over-reliance on a single protocol.
Oracle manipulation remains one of the most persistent attack vectors in DeFi, and the pattern is well-documented enough that teams building new protocols have no excuse for ignoring it. Multi-oracle architectures, time-weighted average price feeds, and circuit breakers for anomalous price movements are all established defensive measures that should be standard in any protocol managing significant TVL.
For NEAR Protocol, the path forward requires structural change. A DeFi ecosystem is only as strong as its most critical dependency, and right now, that dependency is a single protocol that just proved it can be broken. The market will be watching how NEAR responds — and whether it can build the redundancy that its current architecture so clearly lacks.
Disclaimer: This article is for informational purposes only and does not constitute financial advice. Always conduct your own research before making investment decisions.
one protocol holding 95 percent of near defi tvl was a ticking time bomb. 7.6 million gone because nobody diversified
95% of NEAR DeFi TVL in one protocol and nobody on the team thought single point of failure was a problem. this is why eth maxis laugh at other chains
near_maxi_tragedy the Ref and Burrow merger creating one mega protocol looked smart until you realize one bug drains everything. diversification exists for a reason
95% of NEAR DeFi TVL in one protocol. that is the opposite of decentralization. reaper what you sow i guess
exactly. one protocol holding near entire DeFi ecosystem hostage. the mer of ref and burrow made it worse not better
95% TVL in one protocol isnt a Rhea problem its a NEAR ecosystem problem. no competition means no redundancy when the leader fails
fake token contracts to manipulate the oracle is like the oldest trick in the book. ref plus burrow merger just created a bigger target
Dario F. NEAR having zero DeFi competition made Rhea too big to fail and too big to save at the same time. monopoly risk in a nutshell
ref and burrow merged into rea and somehow that was supposed to reduce risk? consolidating into one attack surface is the opposite of resilience. $7.6M gone
the fake token oracle manipulation playbook has been around since 2020. how does a protocol holding 95% of a chains TVL not have multi-oracle redundancy
fake token contracts to manipulate price feeds is literally the oldest trick in defi. rhea had 95% TVL and couldnt afford chainlink or pyth? inexcusable
sentinel_node chainlink wasnt about cost it was about integration. NEARs tooling for external oracles was basically nonexistent pre-2026
Inka T exactly this. NEAR tooling for external oracles was basically prehistoric. teams built their own because nothing else worked
Inka T. NEAR tooling for external oracles being nonexistent is not an excuse. chainlink launched on NEAR in 2023. rhea chose not to integrate because of gas costs. that choice cost them $7.6M
near_ghost_42 the fake token contract trick is the same thing that hit Mango Markets and then Curve pools. oracle designs keep repeating the exact same mistake
Chainlink integration costs real money and NEAR DeFi TVL was too small to justify it. chicken and egg problem for smaller chains
a chain with one dominant DeFi protocol is not a DeFi ecosystem. its a single point of failure with extra steps
fake token contracts distorting price feeds is literally the oldest trick in the book. mango markets, cream, venus, now rhea. nobody learns
95 percent of NEAR DeFi TVL in one protocol and nobody on the team thought that was a systemic risk? this was a ticking bomb not an accident
95% of NEARs TVL in one protocol is insane risk concentration. Rhea merging Ref and Burrow looked smart but created a single point of failure for the entire chain
fake token contracts distorting price feeds is the oldest trick. Chainlink exists for exactly this reason but teams still roll their own oracles to save gas
Ref Finance and Burrow merging into Rhea was supposed to create strength through consolidation. instead it created a single point of failure for the entire chain
rhea merging ref finance and burrow into one mega protocol looked smart on paper but created a single attack surface worth $7.6M. concentration risk killed NEAR DeFi
near_refugee_ the merger was marketed as efficiency gains but really it was survival mode. two protocols with shrinking TVL combining to look bigger. classic crypto M&A
NEAR DeFi is basically just Rhea with extra steps. $7.6M drained through fake token pools because one oracle fed the entire protocol. chain needs competition between protocols, not monopolies