# NEAR Intents Recovered $3.8 Million After 23 Failed Deposits By Simon Yoon Canonical URL: https://www.tokenpost.com/news/technology/33892 Published: 2026-10-17T09:37:23.000Z Updated: 2026-10-17T09:37:23.000Z Section: Technology > A contract flaw let failed deposits remain credited, enabling withdrawals through a cross-chain system. All funds were recovered within 36 hours of the vulnerability’s discovery. NEAR Intents recovered about $3.8 million taken in an Oct. 1 exploit after an attacker used failed deposit calls to inflate balances and withdraw assets through its cross-chain system. The flaw was in a NEAR Intents smart contract. When an interaction with a third-party contract failed, the tokens went back to the depositor, but the deposit remained recorded. The attacker repeated the process in 23 failed transactions, creating about $3.8 million in balances that did not correspond to deposited funds. Those false balances were used to withdraw funds through Omni, the cross-chain infrastructure. NEAR Intents recovered all the funds within 36 hours of discovering the vulnerability. The incident was previously covered in [an update on the Oct. 1 fund recovery](). NEAR Intents removed the deposit notification feature, added monitoring for unusual balances and introduced an automatic pause mechanism. The system has returned to normal operation. A researcher reported another serious vulnerability in the same feature on Oct. 7, and NEAR Intents paid a $300,000 bounty. ## Links in this article - [an update on the Oct. 1 fund recovery](https://www.tokenpost.com/news/technology/26772)