NEAR Intents’ Oct. 16 postmortem traced about $3.8 million in withdrawals to a contract bug that left false deposit credits after failed transactions on its cross-chain service.
A failed call to an external contract triggered a token refund, but the ledger did not reverse its matching credit. Across 23 failed transactions, the attacker accumulated false credits before withdrawing assets through Omni, NEAR Intents’ cross-chain infrastructure. The postmortem says the funds were recovered within 36 hours of finding the vulnerability.
The project added balance monitoring and an automatic pause control, and shut off deposit notifications. NEAR Intents reported that operations had resumed.
A researcher reported a second vulnerability in the same feature on Oct. 7, according to the postmortem. NEAR Intents paid the researcher a $300,000 bounty.
