NEAR Intents Postmortem Links $3.8 Million Exploit to Deposit Bug

A deposit-notification bug let an attacker withdraw $3.8 million from $NEAR Intents before its Oct. 1 shutdown, according to a newly published postmortem. The protocol says it has since removed the feature after another critical vulnerability report.

The report, published Oct. 16 by $NEAR Intents general manager Alex Shevchenko and shared by the protocol, says the attacker returned the full amount within 36 hours of detection. All affected users were made whole, it says.

$NEAR Intents enables cross-chain swaps, with its public settlement contract on $NEAR maintaining an internal ledger of deposited tokens. Its technical documentation identifies that contract as `intents.near`: swaps update ledger balances, while withdrawals move tokens out through bridges.

Refunded Deposits Still Counted as Funds

According to Shevchenko, the vulnerable feature notified third-party contracts when tokens were deposited. The attacker created a contract that deliberately failed those notifications, causing the token contract to refund the deposit while $NEAR Intents retained the corresponding ledger credit.

Across 23 failed deposit transactions, the attacker accumulated $3.8 million in unbacked balances, which the postmortem calls “ghost funds.” The attacker then withdrew real tokens against those balances and moved them to other chains through Omni infrastructure, the report says.

“This was a bug of the $NEAR Intents contract, not a bug of the Omni infrastructure,” Shevchenko wrote.

The report dates the withdrawals from Sept. 29 through Oct. 1. The settlement contract was paused and reopened on Oct. 1, but affected routes remained suspended and reopened gradually over the following days. Contract-side deposits resumed Oct. 2, according to its timeline.

The postmortem does not name affected solvers or give a count of affected users. Its recovery account follows Shevchenko's Oct. 2 announcement that the funds had been returned in full.

A Missing Balance Check

The exploit went undetected because monitoring compared assets on their origin chains with total $NEAR-side token balances, but did not compare users' aggregate internal balances with the tokens actually held by the Intents contract, the postmortem says.

The team says it has added that missing check and an automatic contract pause if the balances diverge.

The postmortem also records a January bug-bounty report involving a similar third-party call feature, which was fixed without being exploited.

A fix for the October exploit was deployed Oct. 2, but another critical bug report in the same feature prompted its complete removal on Oct. 7. Shevchenko said the team awarded the researcher $300,000.