The NEAR Intents Exploit Explained
Quick answer. From September 29 to October 1, 2026, an attacker made NEAR Intents keep credit for refunded deposits and withdrew $3.8M, later returned. Detection came about 40 hours after it began. A balances-versus-holdings check, since added, targets the gap.
Video transcript
NEAR Intents kept credit for deposits that were refunded, and an attacker withdrew real tokens against it.
From September 29 to October 1, the attacker withdrew about 3.8 million dollars. It came back in full the next day.
The attacker deployed a contract built to make deposit notifications fail. Each failure refunded the deposit, but NEAR Intents kept the ledger credit. After 23 failed deposits, the attacker withdrew real tokens against these ghost funds.
Monitoring compared origin-chain assets with NEAR-side totals. It did not compare users' internal balances with the tokens the contract held, where the ghost funds sat. The fix adds that check, with an automatic pause.
About 40 hours passed between the first withdrawal and detection. The last withdrawal came about two hours before the team noticed.
The bug sat in what happened when a notification failed. The tokens went back, and the credit stayed.
Write the invariant that internal balances never exceed tokens held. Check it continuously and pause on a mismatch. Test deposit paths where a callee fails on purpose, confirm refunds reverse credits, and rate-limit hot wallet withdrawals.
Guardian's Managed Security watches contracts on every block, and custom rules can trigger automated pauses. Guardian engineers respond, with a 15-minute SLA on Critical alerts.
Read the full article for the timeline and checks, or talk to Guardian at guardian.security.
NEAR Intents lets users swap crypto across blockchains. On October 1, 2026, it halted services after an exploit of about $3.8M.
The money came back in full the next day. The post-mortem is the useful part.
The team noticed about 40 hours after the first withdrawal. The post-mortem says monitoring compared a different pair of totals.
What Happened
"Earlier today NEAR Intents services were stopped after a security incident was detected," the team posted on October 1, Decrypt reported.
It first pointed to "a bug in the Omni deposit and withdrawal infrastructure" and how it interacted with the NEAR Intents contract. It put the preliminary loss at about $3.8M.
The team said the funds "will be compensated in full," Unchained reported. It also reported the incident to law enforcement.
ZachXBT said the protocol's BSC hot wallet "showed irregular outflows," and that the funds went to KuCoin and were bridged to bitcoin, The Block reported.
General manager Alex Shevchenko then told the attacker, "We have identified you, sir," and set a 48-hour window to return the funds, Decrypt reported.
On October 2, Shevchenko said the funds "were sent back in full." He shared a message attached to a transaction that appears to come from the exploiter: "We've returned all the funds, we were in the wrong."
How the Attack Worked
Shevchenko published the post-mortem on X on October 16. The details here come from reports of it by ChainCatcher, The Defiant and DeFiprime.
It says the flaw was in the NEAR Intents contract, not in the Omni infrastructure.
Ghost funds
The contract had a deposit notification feature. When tokens were deposited, it notified a third-party contract.
- The attacker deployed a contract built to make those notifications fail.
- Each failure made the token contract refund the deposit.
- NEAR Intents kept the matching ledger credit anyway.
- After 23 failed deposits, the attacker held $3.8M in balance with nothing behind it.
- The attacker then withdrew real tokens against that balance.
The post-mortem calls these balances "ghost funds." Onchain, about 3.87 million USDT left a contract listed as the HOT Bridge treasury on BNB Chain, Unchained reported.
Why monitoring missed it
Monitoring compared assets on their origin chains with total NEAR-side token balances, the post-mortem says.
It did not compare users' internal balances with the tokens the contract actually held. That is where the ghost funds sat.
Timeline and Loss
Times are UTC, from the post-mortem as DeFiprime reports it, unless noted.
| Date (2026) | Event |
|---|---|
| Sep 29, 16:14 | First withdrawal against ghost balances |
| Oct 1, 05:54 | Last withdrawal |
| Oct 1, 08:04 | Team identifies withdrawal problems |
| Oct 1, 08:33 | Intents contract paused |
| Oct 1, 11:20 | Contract resumes; affected routes stay paused |
| Oct 2 | Funds returned in full (Shevchenko, via Decrypt) |
| Oct 2, 20:31 | Fix deployed; deposits resume at 20:38 |
| Oct 7 | Deposit notifications removed after another critical report (GitHub PR #374) |
| Oct 16 | Post-mortem published (ChainCatcher) |
On BNB Chain, Unchained's onchain read found five transfers of 35,000 to 1.5 million USDT between 7:54 pm ET on September 30 and 2:08 am ET on October 1.
The loss, with each figure attributed:
- Taken: about $3.8M, per NEAR Intents' preliminary report. Unchained counted about 3.87 million USDT onchain.
- Returned: in full, per Shevchenko on October 2.
- Users: all affected users fully compensated, per the post-mortem.
- Second bug: a separate critical report on the same feature earned its researcher $300,000, per the post-mortem.
What It Shows
Monitoring has to watch the right number
NEAR Intents had monitoring. It checked one pair of totals, and the attack moved a different one.
The post-mortem's fix compares internal user balances with the tokens the contract holds. The team says it "will automatically pause the contract when there is a balance inconsistency."
Exchanges face the same question with hot wallets. Our hot wallet monitoring guide covers real-time reconciliation.
Failure paths are attack paths
The bug sat in what happened when a notification failed. The tokens went back, and the credit stayed.
A January bug bounty report had covered a similar third-party call feature, which the team says it fixed within two days, DeFiprime reported.
An unbacked credit works like an unbacked mint. Our guide to infinite mint attacks covers the controls.
Detection time is loss time
About 40 hours passed between the first withdrawal and detection. The last withdrawal came about two hours before the team noticed.
Our time-to-detection report found most known drains ended before any public alert.
Checks to run
- Write the invariant: internal balances never exceed tokens held, per token.
- Check it continuously, and pause automatically on a mismatch.
- Test every deposit path where a callee can fail on purpose.
- Confirm a refund always reverses the matching credit.
- Rate-limit withdrawals from hot wallets and treasury contracts.
- Alert on unusual withdrawal size and frequency, per token.
How Managed Security Covers This
Guardian's Managed Security includes 24/7 monitoring and direct response, run by Guardian's MDR team.
Guardian monitors contracts on every block: privileged calls, role and ownership changes, upgrades, multisig transactions and large fund movements.
Monitors are customized to each protocol. They run alongside out-of-the-box detectors for suspicious contracts and known exploit patterns.
Custom rules can trigger actions, including automated pauses. When something fires, a Guardian engineer responds, with a 15-minute SLA on Critical alerts.
For how a managed team differs from tooling alone, read what Web3 MDR is.
Frequently Asked Questions
What happened in the NEAR Intents exploit?
An attacker used failed deposit notifications to build about $3.8M in unbacked balances, then withdrew real tokens against them from September 29 to October 1, 2026. Services halted October 1; the funds came back in full October 2.
Was the bug in Omni or in NEAR Intents?
NEAR Intents first pointed to how its Omni deposit and withdrawal infrastructure interacted with its contract. Its October 16 post-mortem, as reported by ChainCatcher, says the flaw was in the NEAR Intents contract, not the Omni infrastructure.
Why didn't monitoring catch the NEAR Intents exploit?
Per the post-mortem, monitoring compared origin-chain assets with NEAR-side token totals, not users' internal balances with the tokens the contract held. Detection came about 40 hours after the first withdrawal. The team has added that check, with an automatic pause.
Were the stolen funds returned?
Yes. On October 2, 2026, general manager Alex Shevchenko said the funds "were sent back in full." The post-mortem says all affected users were fully compensated.
Sources
- Decrypt: Near Intents Hacked for $3.8M Days After Denying North Korea-Linked Bitget Hacker (October 1, 2026)
- The Block: NEAR Intents halts services after $3.8 million exploit, promises full compensation (October 1, 2026)
- Unchained: NEAR Intents Pledges Full Compensation After a Bug Lets an Attacker Drain $3.8 Million (October 1, 2026)
- Cointelegraph: NEAR Intents recovers entire stolen $3.8M after ultimatum to exploiter (October 3, 2026)
- Decrypt: 'We Have Identified You, Sir': Near Intents Recovers $3.8 Million After 48-Hour Ultimatum (October 4, 2026)
- ChainCatcher: NEAR Intents released a post-mortem report, revealing that the $3.8 million vulnerability originated from a deposit notification flaw (October 17, 2026)
- The Defiant: NEAR Intents Postmortem Links $3.8 Million Exploit to Deposit Bug (October 16, 2026)
- DeFiprime: NEAR Intents Recovers $3.8M After Contract Exploit (October 17, 2026)
- GitHub: near/intents pull request 374, remove notifications on deposits (merged October 7, 2026)
- Guardian: Managed Security
- Guardian: Guardian Announces Managed Security
Put an engineer on every alert
Guardian's Managed Security monitors your contracts on every block, with custom rules, automated pauses and a 15-minute SLA on Critical alerts.