Rhea Finance said an exploit drained approximately $18.4 million from its lending protocol on Thursday, more than doubling early estimates that had pegged losses at around $7.6 million.

The updated figure comes from a post-mortem published Friday, where the Rhea team shared more details of the attack that targeted the protocol’s margin trading feature.

Using what the team described as a "deliberately constructed swap route," the attacker opened a large number of margin trading positions.

"Borrowed debt tokens were funneled into the attacker’s fake token pools, while only a negligible amount of position tokens were returned to the protocol," the report said. Positions were then left undercollateralized, triggering liquidations that "resulted in the depletion of the protocol’s reserve pool."

Rhea said the exploit resulted in “realised losses within the protocol,” affecting reserves and users.

A large portion of the funds has since been recovered or frozen. The attacker returned roughly 3.36 million USDC and 1.56 million NEAR (worth roughly $3.5 million) to the protocol, while about 4.34 million USDT has been frozen, according to the team and confirmed by Tether CEO Paolo Ardoino.

The protocol paused affected contracts and claims to be working with exchanges and investigators to trace the outstanding token value of around $5.6 million. The team said a compensation and recovery framework is in the works, but gave no specific details as to what that might look like.

Aurora Labs and Near Intents co-founder Alex Shevchenko sent the attacker an onchain message warning the sender that they had "identified you and your associated accounts" and called for the return of the rest of the assets.