NEAR Intents Traces $3.8M Exploit to Refund Bug, Pays Researcher $300K for Related Flaw

Published October 17, 2026, 07:07 PKT. Based on NEAR Intents' security incident postmortem published October 16, 2026 (primary source, shared by general manager Alex Shevchenko on X), secondary reporting by The Crypto Times and PANews on October 17, 2026, and TokenPost's October 13, 2026 reporting on the returned funds.

NEAR Intents has published a postmortem of the exploit that drained roughly $3.8 million from its cross-chain protocol in late September and early October, blaming a smart contract bug in its deposit handling rather than the Omni infrastructure it uses to move assets between blockchains. The report, shared by NEAR Intents general manager Alex Shevchenko on X on October 16, says the attacker exploited a deposit notification feature: 23 specially crafted failed transactions created what Shevchenko called "$3.8M of ghost funds," balances the contract recorded with no tokens behind them, which the attacker then withdrew and moved off NEAR through Omni.

How the attacker minted "ghost funds"

The exploited feature let the Intents contract notify a third-party contract whenever tokens were deposited, The Crypto Times reported. The attacker deployed a NEAR contract designed to make those notification calls fail on purpose. When a call failed, the token contract returned the deposited funds, but the Intents contract kept the corresponding deposit record. After 23 failed transactions between September 29 and October 1, those phantom records made the contract look richer than it actually was, and the attacker withdrew approximately $3.8 million and routed it to another chain through Omni. Shevchenko said the flaw lived in the NEAR Intents contract's handling of failed calls in NEAR's asynchronous runtime, not in Omni's infrastructure.

A 40-hour blind spot in monitoring

The withdrawals ran from 16:14 UTC on September 29 to 05:54 UTC on October 1. The team spotted the problem at 08:04 UTC on October 1 and paused the contract 29 minutes later. The monitoring systems compared balances on origin chains with total token balances on NEAR, but they never compared the balances the Intents contract had recorded for users against the tokens the contract actually held, according to the postmortem. That gap let the unbacked balances sit undetected for nearly 40 hours. Independent blockchain investigator ZachXBT also flagged abnormal outflows from a BNB Chain hot wallet tied to NEAR Intents and published a theft address. The contract was unpaused later on October 1, with affected routes restored gradually, and a fix reached mainnet on October 2, The Crypto Times said.

The $300,000 bounty and the dead feature

The same deposit notification feature had raised alarms before. A bug bounty report in January identified a similar issue with third-party contract calls; the team fixed it within two days and it was never exploited. Then, on October 7, a second critical report flagged a further issue in the same feature, and NEAR Intents removed the feature entirely that day. That report came from researcher Rohan Ganapa through the protocol's HackenProof bug bounty program, and he received a $300,000 reward for the finding, the postmortem says. "The feature had a history of bug reports, all in the gap between its two steps," Shevchenko wrote.

The 36-hour recovery

All the money came back. The postmortem says the full $3.8 million was recovered within 36 hours of detection, with help from the protocol's SHIELD risk system, blockchain analysis firms and external security researchers. On October 2, Shevchenko said the exploiter had been identified and set an October 4 deadline for the funds to be returned; the full amount arrived before the deadline. The returned funds included Bitcoin and Monero. TokenPost reported that 34.59 BTC made up about 78 percent of the returned total, with the rest converted into Monero, and that the team had already replenished its contracts with its own money while working to convert the Monero into Tether. The attacker left an onchain message that read, "We've returned all the funds, we were in the wrong." The attacker's identity has not been publicly disclosed.

New checks and a warning to developers

NEAR Intents has changed its monitoring to compare the balances users are recorded as holding against the tokens the contract actually holds, with the system set to pause automatically if the two do not match. The team also plans to prioritize formal verification, a method that uses mathematical techniques to check smart contracts against specified properties. Shevchenko urged other NEAR developers to review how their own contracts handle token refunds and asked protocols and security teams to share incident information with SHIELD to support future investigations.

This article is news reporting and is not investment advice.

Sources

• NEAR Intents security incident postmortem, published October 16, 2026 (shared by general manager Alex Shevchenko on X), primary source for the root cause (failed deposit notification calls creating $3.8M in unbacked "ghost funds" across 23 transactions), the September 29 to October 1 withdrawal window, the 40-hour monitoring gap, the $300,000 bounty paid to Rohan Ganapa, the January and October 7 bug reports, the deposit feature removal, and the 36-hour full recovery
• The Crypto Times, October 17, 2026, secondary source for the postmortem details, the Omni vs Intents-contract distinction, the 08:04 UTC October 1 detection and 29-minute pause, ZachXBT's flagging of the BNB Chain hot wallet outflows, the October 2 mainnet fix, and the new automatic-pause monitoring
• PANews, October 17, 2026, secondary source for the abnormal balance monitoring, the automatic pause mechanism, and the deposit notification feature removal
• TokenPost, October 13, 2026, secondary source for the return composition (34.59 BTC, about 78 percent of the total, remainder in Monero) and the team's plan to convert the Monero into Tether (USDT)