Rhea Finance attack review, losses expanded to 18.4 million USD, some funds have been recovered

Rhea Finance released an attack review report, confirming that the actual loss from this vulnerability is approximately $18.4 million, significantly up from the initial estimate of about $7.6 million. The attacker constructed complex trading paths, manipulated liquidity using fake token pools, and directed borrowed assets into pools under their control, while only returning a minimal amount of assets, causing a large number of margin positions to quickly become under-collateralized and trigger liquidation, ultimately depleting the protocol's reserve funds.

Currently, approximately $11.2 million in funds have been recovered or frozen, including some USDC and NEAR assets returned by the attacker, as well as about $4.34 million in USDT that has been frozen (with assistance from Tether).