NEAR Intents Recovers $800,000 Following Smart Contract Exploit

The NEAR Intents protocol has published a comprehensive post-mortem report regarding a security breach that occurred on October 1, 2026. The incident, which stemmed from a vulnerability in the protocol's smart contract interaction logic, resulted in the unauthorized generation of $800,000 in artificial balances. Following a swift response by the development team, the protocol confirmed that all misappropriated funds have been successfully recovered, and the system has returned to normal operations.

Mechanism of the Exploit and Mitigation

The security flaw was specifically located within the NEAR Intents smart contract and involved a malfunction in the refund mechanism during interactions with third-party contracts. Attackers leveraged 23 failed deposit transactions to trigger a state where funds were refunded to the sender while the system simultaneously recorded the deposits as successful. This discrepancy allowed for the creation of fake balances, which were subsequently withdrawn using the Omni cross-chain infrastructure.

It is important to note that the Omni infrastructure itself was not compromised; the vulnerability was contained entirely within the NEAR Intents deposit notification feature.

In the wake of the discovery, the team implemented several critical security enhancements:

• The problematic deposit notification feature has been completely removed from the codebase.
• New abnormal balance monitoring tools have been integrated to detect real-time discrepancies.
• An automatic pausing mechanism was introduced to halt protocol activity in the event of suspicious movements.
• The protocol completed the full recovery of the $800,000 within 36 hours of the initial breach.

Commitment to Protocol Security

Beyond resolving the October 1st incident, the NEAR Intents team demonstrated a proactive approach to long-term safety. On October 7th, a security researcher identified another critical vulnerability within the same feature set. To acknowledge the contribution to the ecosystem's safety, the protocol awarded the researcher a $50,000 bounty. This move underscores the project's shift toward more rigorous auditing and community-driven security oversight.

The recovery of assets and the patching of the contract logic signify a stabilization for the NEAR ecosystem participants who utilize these intent-based cross-chain tools. By providing a transparent breakdown of the failed calls and the subsequent "fake balance" generation, the team aims to provide a technical case study for other developers working on interoperability solutions and cross-chain messaging.