NEAR Intents Recovered $3.8 Million After 23 Failed Deposits

NEAR Intents recovered about $3.8 million taken in an Oct. 1 exploit after an attacker used failed deposit calls to inflate balances and withdraw assets through its cross-chain system.

The flaw was in a NEAR Intents smart contract. When an interaction with a third-party contract failed, the tokens went back to the depositor, but the deposit remained recorded. The attacker repeated the process in 23 failed transactions, creating about $3.8 million in balances that did not correspond to deposited funds.

Those false balances were used to withdraw funds through Omni, the cross-chain infrastructure. NEAR Intents recovered all the funds within 36 hours of discovering the vulnerability. The incident was previously covered in an update on the Oct. 1 fund recovery.

NEAR Intents removed the deposit notification feature, added monitoring for unusual balances and introduced an automatic pause mechanism. The system has returned to normal operation.

A researcher reported another serious vulnerability in the same feature on Oct. 7, and NEAR Intents paid a $300,000 bounty.