Key Highlights
- NEAR Intents’ postmortem attributes the $3.8 million exploit to a smart contract bug, not its Omni infrastructure.
- The attacker used 23 failed deposit transactions between September 29 and October 1 to create balances not backed by tokens held in the contract.
- The postmortem says NEAR recovered all funds within 36 hours of detecting the exploit.
NEAR Intents has published a postmortem explaining how a smart contract bug enabled an attacker to withdraw nearly $3.8 million from the cross-chain protocol between September 29 and October 1.
In an article shared on X on October 16, NEAR Intents general manager Alex Shevchenko said the flaw involved calls to third-party contracts during deposits. The contract continued recording deposits even when the corresponding tokens had been returned.
NEAR Intents halted swaps on October 1 after approximately $3.8 million left a BNB Chain hot wallet associated with the protocol.
How the attacker created $3.8 million in “ghost funds”
NEAR Intents uses Omni infrastructure to move assets between blockchains, while its Intents contract on NEAR handles deposits and settlement. The system tracks tokens on the origin chain, tokens on NEAR, and balances recorded internally by the Intents contract.
The exploited feature allowed the contract to notify a third-party contract when tokens were deposited. According to the postmortem, the attacker deployed a NEAR contract designed to make these notification calls fail.
When a call failed, the token contract returned the deposited funds, but the Intents contract retained the corresponding deposit record. The attacker repeated this process across 23 failed transactions, creating what Shevchenko described as “$3.8M of ghost funds.”
These incorrect records made the contract appear to hold more tokens than it actually did. The attacker exploited this discrepancy to withdraw approximately $3.8 million and move the funds to another chain through Omni.
Shevchenko also highlighted the complexity of handling failed calls in NEAR’s asynchronous runtime, which requires contracts to account for failures in follow-up operations.
A monitoring gap allowed the exploit to continue
According to the postmortem, the attacker withdrew funds between 16:14 UTC on September 29 and 05:54 UTC on October 1. The team identified the withdrawal issue at 08:04 UTC on October 1 and paused the contract 29 minutes later.
The monitoring systems compared balances on origin chains with total token balances on NEAR. However, they did not compare the balances recorded for NEAR Intents users with the tokens actually held by the Intents contract. This gap allowed the unbacked balances to go undetected for nearly 40 hours after the first reported withdrawal.
Moreover, Blockchain investigator ZachXBT flagged abnormal outflows from a BNB Chain hot wallet associated with NEAR Intents. The investigator also flagged a theft address: 0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37.
The contract was unpaused later on October 1, with affected routes restored gradually. A fix was deployed to mainnet on October 2.
A deposit feature had received earlier bug reports
The postmortem says a bug bounty report in January identified a similar issue involving third-party contract calls. The team fixed that issue within two days, and it was not exploited.
On October 7, another critical bug report identified a further issue in the same deposit notification feature. NEAR Intents removed the feature that day. “The feature had a history of bug reports, all in the gap between its two steps,” Shevchenko wrote.
The October report came from researcher Rohan Ganapa through the protocol’s HackenProof bug bounty program. He received a $300,000 reward for the finding.
NEAR Intents recovered the stolen funds
According to the postmortem, all funds were recovered within 36 hours of detection, with assistance from SHIELD, blockchain analysis, and external security researchers.
On October 2, Shevchenko said the exploiter had been identified and set an October 4 deadline for returning the funds. The full amount was returned before the deadline. He said the returned funds included Bitcoin and Monero. NEAR Intents had already replenished its contracts using its own funds and was working to convert the returned Monero.
The attacker also left an onchain message stating, “We’ve returned all the funds, we were in the wrong.”
The attacker’s identity has not been publicly disclosed in the cited reports.
Automatic pausing added to balance monitoring
NEAR Intents has updated its monitoring to compare users’ recorded balances against the tokens actually held by the contract. The system is designed to pause automatically if the balances do not match. The postmortem says the team also plans to prioritize formal verification, which uses mathematical methods to check smart contracts against specified properties.
Shevchenko urged other NEAR developers to review how their contracts handle token refunds. He also encouraged protocols and security teams to share incident information with SHIELD to support future investigations.
Also Read: Vitalik Wraps AI Agents in Tor + zkAPI for True Paranoid Mode
