NEAR Intents' $3.8M Deposit-Notification Exploit: How Failed Deposits Created Fake Balances, and How Every Dollar Came Back
An attacker exploited a deposit-notification accounting flaw to create approximately $3.8 million in unsupported balances and withdraw real assets through Omni's cross-chain infrastructure. NEAR Intents paused operations and patched the affected contract. After general manager Alex Shevchenko publicly said the team had identified the attacker and issued a 48-hour return deadline, the funds were returned in full on October 2. The project then announced that it was stopping its investigation. Later post-mortem reporting attributed the flaw to NEAR Intents' handling of failed deposit notifications, rather than an exploit of Omni itself.
This article is published for educational and informational purposes only. It does not constitute legal, financial, or investment advice. Nothing in this article should be relied upon as the sole basis for any decision relating to the security, investment value, or legal standing of any protocol or digital asset.
This is a preliminary analysis based on publicly available reporting and open-source code review. An official post-mortem has not yet been published by the affected protocol at time of writing. Any code samples included are illustrative reconstructions for educational purposes only and do not represent confirmed exploit code. This article will be updated when authoritative technical disclosure is available.
Information published on any code vulnerabilities must not be used to attack, test, or probe any protocol or system without explicit authorisation from its owner. Use of this content is subject to our Terms of Service and Privacy Policy.
What happened
On October 1, 2026, NEAR Intents detected that an attacker had exploited a flaw in how it handled deposit notifications. The attacker built up approximately $3.8 million in balances with nothing behind them, then used those balances to withdraw real assets through Omni's cross-chain infrastructure. NEAR Intents paused operations and patched the affected contract.
General manager Alex Shevchenko then published return addresses and warned the attacker, "We have identified you, sir", giving a 48-hour window to return the assets. NEAR co-founder Illia Polosukhin said the team identified the responsible party less than 24 hours after the hack, established communication, and recovered the funds in full.
According to NFT Evening, the funds came back on October 2, before the deadline expired, with help from SHIELD and internal investigators. Shevchenko then announced: "We are stopping the investigation." The settlement contract resumed with fixes the same day.
Root cause
Early reports described a bug in how Omni's infrastructure interacted with the NEAR Intents contract. The October 16 post-incident report placed the flaw more precisely in NEAR Intents' own deposit-notification accounting. Omni was the route the money left through, not the source of the bug, and the NEAR blockchain itself was not compromised.
Failed deposits that still counted
When a deposit came in with a notification, NEAR Intents tried to pass it on to a third-party contract. As TokenPost explained, if that call failed, the tokens were sent back to the depositor, but the deposit stayed credited to their balance. The user ended up with both the tokens and the credit.
The attacker made notifications fail on purpose. Each failed deposit returned the tokens and left a fake balance behind. Repeating this across 23 transactions between September 29 and October 1 built up about $3.8 million in balances that could be withdrawn as real tokens.
// Intended flow
deposit(tokens, notify) -> credit balance
notify third-party -> success
result = tokens held, balance credited
// Exploited flow
deposit(tokens, notify) -> credit balance
notify third-party -> fails (forced by attacker)
refund tokens to sender -> tokens returned
balance credit -> NOT reversed <-- bug
result = tokens returned AND balance kept
// Repeated 23 times, Sep 29 - Oct 1
fake_balance = ~$3.8M
withdrawn = real assets via Omni cross-chain infrastructure
// Response
oct_1 = detected, operations paused
oct_2 = funds returned in full, contract resumed with fixes
oct_7 = notification feature removed after second critical bug
oct_16 = post-incident report publishedA second bug in the same feature
After the relaunch, a researcher found a second critical issue in the same notification feature. NEAR Intents removed the feature entirely on October 7, and the researcher reportedly received a $300,000 bounty. This was a later discovery reported through the bounty program, not a second theft.
What could have been done
- Undo the credit whenever a deposit is refunded. Crediting a balance and refunding the tokens must happen as a pair. Any code path that returns tokens to the sender must also reverse the credit, or never apply it until the whole deposit succeeds.
- Test the failure paths, not just the happy path. The bug only appeared when the third-party call failed. Tests and audits should force every external call to fail and check that balances still add up afterward.
- Check balances against real holdings continuously. Total user credits should never exceed the tokens the contract actually holds. An automated check comparing the two would have flagged the gap after the first few failed deposits instead of after $3.8 million.
- Limit withdrawals from newly created balances. Large withdrawals soon after unusual deposit activity can be held for review or rate-limited, which gives the team time to spot fake balances before real assets leave.
- Remove complex features when they keep breaking. NEAR Intents did this after the second bug, removing the notification feature rather than patching it again. Fewer code paths around deposits mean fewer ways to get the accounting wrong.
- Fund a bounty program that pays well. The $300,000 bounty for the second issue shows the value of paying researchers to report bugs instead of exploiting them.
Lessons for the industry
The NEAR Intents exploit is a classic accounting bug. Nothing was wrong with the cryptography, the blockchain, or the cross-chain infrastructure. One code path refunded tokens without reversing the matching credit. Bugs like this are easy to miss because the normal flow works perfectly, and the flaw only appears when something goes wrong in a way the attacker can control.
It also shows how early reports can point at the wrong component. Omni was named at first because the funds left through it. The post-mortem put the fault in NEAR Intents' own bookkeeping. Waiting for a proper root cause before blaming shared infrastructure matters, because other teams build on top of it.
The recovery was fast and complete: the team identified the attacker within a day, issued a public deadline, and had the funds back within 36 hours of detection. That outcome is not something other protocols can count on. Most attackers are not identified, and most funds are not returned. The more reliable defense is the one NEAR Intents chose afterward: removing the feature, checking the failure paths, and paying researchers to find the next bug first.
- 01Decrypt via Yahoo Finance, “We have identified you, sir”: NEAR Intents recovers $3.8 million
- 02Yahoo Finance, NEAR Intents says exploited $3.8 million is back, closes investigation
- 03NFT Evening, NEAR Intents recovers $3.8 million in full
- 04Gate, October 16 post-incident report summary
- 05TokenPost, NEAR Intents recovered $3.8 million after 23 failed deposits