NEAR Intents announces progress on its vulnerability incident: Attackers exploited a flaw in deposit notifications to generate fake balances, and all funds have been returned.

Cross-chain swap protocol NEAR Intents has released a post-mortem report on its recent vulnerability incident, disclosing that the $3.8 million asset extraction stemmed from a flaw in its deposit notification function. Attackers created smart contracts intentionally causing notification failures, resulting in deposited tokens being refunded while the protocol’s internal ledger still recorded the corresponding balance. Over 23 failed deposit transactions, the attackers accumulated $3.8 million in fake, unbacked balances, then withdrew real tokens between September 29 and October 1, transferring them to other blockchains via Omni infrastructure. Alex Shevchenko, general manager of NEAR Intents, emphasized the vulnerability resided in NEAR Intents’ contracts, not Omni’s infrastructure. The protocol added that the attacker repaid all funds within 36 hours of the bug being identified, and affected users have received full compensation. The team has since enhanced balance monitoring mechanisms and permanently removed the vulnerable function on October 7. Additionally, a security researcher who discovered the critical vulnerability was awarded a $300,000 bounty.