At 15:56 UTC on October 16, 2026, NEAR Intents contributor Alex Shevchenko published a postmortem for an October 1 contract exploit that created $3.8M of unbacked internal balances. The attacker withdrew the same amount through the protocol’s Omni infrastructure. NEAR Intents said the full amount was returned within 36 hours of detection and all affected users were made whole.
The exploit used a deposit feature that called third-party contracts on NEAR. An attacker deployed a receiver contract that made those notification calls fail. The token contract then refunded the deposited tokens, while the NEAR Intents contract retained its record of the deposit. The postmortem calls the resulting entries “ghost funds.”
The attacker repeated the failure across 23 deposit transactions. Those transactions made the Intents ledger behave as if it held $3.8M more than the token contract’s balance_of value showed. Because the available token balance remained large enough to cover the attacker’s internal credit, the attacker could withdraw $3.8M and bridge it to a foreign chain through Omni.
How the accounting gap formed
NEAR Intents separates assets across three accounting locations. Tokens remain backed on their origin chains, corresponding tokens exist on NEAR, and a subset of the NEAR-side tokens sits inside the Intents contract for settlement. Other NEAR accounts can hold the rest.
The failed callback broke the relationship between the last two locations. The token contract reversed the deposit after the recipient call failed, but the Intents ledger did not reverse the user’s credited amount. In the postmortem’s notation, NEAR-side token contracts accounted for X assets while the Intents contract actually held a smaller amount Y. Its internal ledger behaved as if it held Y plus $3.8M.
The team attributed the bug to the NEAR Intents contract rather than Omni. Omni processed a withdrawal that the Intents ledger treated as valid. For depositors and solvers, that distinction matters because the removed behavior sat at the point where Intents accepted tokens and notified an external contract. The bridge was the route used to move the withdrawn assets, not the component that created the false balance.
NEAR’s asynchronous runtime made failed follow-on calls part of the contract’s required accounting logic. The network’s fungible-token standard supports a “transfer and call” flow so users do not need separate Ethereum-style approval and contract-call transactions. Contracts using that flow must still handle failures, including out-of-gas exceptions, without preserving credit for funds that were returned.
A related warning had reached the team earlier. A bug bounty report submitted from January 13 to January 15 covered a similar third-party call feature. The team said it fixed that issue on mainnet within two days and that attackers did not exploit it. More security changes reached the Intents main branch from January through March. The October incident involved the remaining deposit-notification path, which still split token movement and the external call across two steps.
Detection, pause, and recovery
The withdrawals ran from September 29 at 16:14 UTC until October 1 at 05:54 UTC. The team identified withdrawal problems at 08:04 UTC on October 1 and paused the Intents contract at 08:33 UTC. The near.com frontend entered maintenance mode at 08:40 UTC.
The contract resumed at 11:20 UTC, although affected routes remained paused and returned gradually over the following days. The frontend left maintenance mode at 14:00 UTC. NEAR Intents said investigation, public-chain analysis, security researchers, and negotiations with the attacker led to the return of all funds on October 2. The team deployed the fix at 20:31 UTC that day and unpaused contract-side deposits at 20:38 UTC.
The postmortem also describes the monitoring gap. Existing systems compared assets on origin chains with the total corresponding token balances on NEAR. They did not compare the aggregate balances assigned to Intents users with the token balance held by the Intents contract itself. That omission let the attacker repeat the failing transaction over multiple days before withdrawal problems surfaced. The team therefore described detection time as a problem even though it considered the reaction fast once operators found the withdrawal issue. Its old checks could confirm cross-chain backing while missing an internal contract deficit.
The feature is gone
NEAR Intents removed deposit notifications after another critical report on October 7. The team said the feature had a history of reports involving the gap between its two steps. It paid the researcher who submitted the latest report through its bug bounty $300k. The bounty program offers up to $300k for critical findings.
The replacement control monitors the total balance of Intents users against the contract’s token balance. The contract now pauses automatically if that invariant fails. This changes the failure mode for users: a discrepancy should stop the contract instead of remaining available for repeated deposits and later withdrawals.
The response also separates a global contract pause from route-level controls. During the incident, the team unpaused the contract while affected routes remained unavailable and returned them gradually. Depositors could therefore see one path remain closed after the wider contract resumes. An automatic invariant failure may likewise interrupt access while operators investigate the mismatch. Builders also lose the removed deposit callback, which had notified a recipient contract during a deposit. The safer path eliminates the two-step interaction that produced the false credit.
NEAR Intents is also working on formal verification and further development of SHIELD, its security layer. The postmortem does not give a dated milestone for either effort. The next check for depositors and integrators is whether the new invariant catches accounting differences across every supported token path without causing unnecessary pauses.
