On April 16, 2026, Rhea Lend on NEAR was exploited via chained swap path that defeated margin module's slippage protection. Attacker spent April 13-15 deploying fake token contracts and eight Ref Finance pools, then executed complex swap reusing intermediate assets to drain reserves. Oracle accepted attacker-created pool prices as legitimate.