NEAR Intents Postmortem Links $3.8 Million Exploit to Deposit Bug
How the exploit worked
A bug in NEAR Intents' deposit notification system allowed an attacker to steal $3.8 million before the protocol shut down on Oct. 1. The postmortem was published Oct. 16 by NEAR Intents general manager Alex Shevchenko.
The protocol lets users swap tokens across different blockchains. When someone deposits tokens, the system notifies third-party contracts. The attacker built a contract that deliberately blocked those notifications. This caused the token contract to refund the deposit, but NEAR Intents kept the credit on its internal ledger. The attacker repeated this across 23 transactions, creating $3.8 million in "ghost funds" with no real tokens backing them.
What the protocol found
- The attacker withdrew real tokens against the fake balances and moved them to other chains using Omni infrastructure
- The team missed the exploit because its monitoring only compared tokens on their origin chains with NEAR-side balances, not users' internal balances against actual tokens held
- A January bug bounty report had flagged a similar issue in the same feature, but it was fixed before anyone exploited it
What NEAR Intents has done
The postmortem says the attacker returned all the funds within 36 hours of detection. The protocol added a balance check that pauses the contract automatically if internal and actual token amounts diverge. It also removed the deposit notification feature entirely on Oct. 7 after another critical bug report came in. The team paid the second researcher a $300,000 bounty.
Why this matters for cross-chain protocols
NEAR Intents relies on an internal ledger to track deposited tokens across blockchains. The exploit showed that even a small gap in how those balances are monitored can let someone withdraw real assets they never actually deposited. Cross-chain protocols that use similar ledger systems may face the same risk if they do not verify that internal balances match the tokens they actually hold.
What is still unclear
The postmortem does not name the attacker or identify which solvers or users were affected by the exploit. It also does not specify the exact total number of users who were refunded.
Next steps
Contract-side deposits resumed on Oct. 2 after the fix was deployed. Routes were gradually reopened over the following days after the contract was paused and restored on Oct. 1.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.