NEAR Intents Returns $3.8M Lost in Deposit-Callback Flaw
Security & Exploits ·
The protocol says every affected account has been made whole after a contract defect let an attacker generate inflated internal balances and move the funds off-chain through its Omni bridge.
NEAR Intents disclosed on October 16, 2026, that it recovered $3.8M tied to an October 1 exploit in which a flaw in its deposit handling produced token balances that existed only inside the protocol's own ledger, not on the underlying token contracts. The disclosure, posted by contributor Alex Shevchenko, states the full sum was returned within 36 hours of detection and that affected users suffered no net loss, a timeline detailed in the postmortem covered by DefiPrime.
The underlying mechanism involved a deposit step that triggers a call to a separate, third-party contract after tokens arrive. The attacker set up a receiving contract engineered to make that follow-up call fail. When the call failed, the token contract rolled back the deposit and returned the tokens, but the Intents ledger never reversed the corresponding credit it had already recorded, leaving what the team termed "ghost" balances. Repeating this across 23 separate deposits let the attacker accumulate $3.8M in phantom credit, which was then withdrawn and routed out through the Omni bridge — a path that moved the funds but was not itself where the error occurred, according to the Leviathan News account of the incident.
NEAR Intents tracks value across three layers — the origin chain, mirrored tokens on NEAR, and the subset held directly by the Intents contract for settlement — and the bug broke synchronization between the latter two, letting the internal ledger overstate holdings relative to actual token-contract balances. The team noted that NEAR's asynchronous transaction model, which allows a single deposit-and-call sequence instead of separate approval steps, requires contracts to handle failed follow-up calls without retaining credit for funds that bounced back, a requirement this deposit path did not fully satisfy.
A related issue had surfaced earlier: a bug bounty submission between January 13 and 15 flagged a similar third-party-call weakness, which was patched on mainnet within two days before any exploitation occurred, with further hardening added between January and March. The October incident exploited the deposit-notification mechanism that remained in place. In response, NEAR Intents removed deposit notifications entirely