NEAR Intents exploit: ghost deposits, $3.8M returned

About $3.8M, per NEAR Intents; $3.86M across five BNB Chain treasury payouts, per CertiK; 3,865,000 USDT (on-chain). Returned in full on 2 Oct, per NEAR Intents and Illia Polosukhin.

Root cause: Per NEAR Intents: a deposit notification to a third-party contract could fail so that the token contract refunded the deposit while the Intents contract kept the credit ('a bug of the NEAR Intents contract, not a bug of the Omni infrastructure'). Per CertiK: an oversized refund log exceeded NEAR's 16,384-byte log limit and failed the deposit resolver.

Timeline, as sourced: Withdrawals 29 Sep 2026 16:14 to 1 Oct 05:54 (per NEAR Intents; zone not stated); BNB Chain payouts 30 Sep 23:54 to 1 Oct 06:08 UTC (on-chain); contract paused 1 Oct 08:33 (per NEAR Intents); funds returned 2 Oct 14:30 UTC (per Illia Polosukhin); fix deployed 2 Oct 20:31 (per NEAR Intents).

Between 29 September and 1 October 2026 an attacker withdrew about $3.8M from NEAR Intents, according to the team's postmortem (opens in a new tab). NEAR Intents says its contract could notify a third-party contract on NEAR when tokens were deposited. The attacker deployed a contract that made those notifications fail, so the token contract returned each deposit while Intents kept the credit; 23 such deposits created $3.8M of balances the contract did not hold, which the attacker withdrew through the Omni infrastructure. The team says the bug was in the Intents contract, not in Omni. CertiK (opens in a new tab) traces the failure to an oversized refund log that exceeded NEAR's 16,384-byte limit and failed the deposit resolver, and counts five payouts from the HOT bridge treasury on BNB Chain totalling $3.86M. On-chain, those payouts sent 3,865,000 USDT between 30 September 23:54 UTC (first (opens in a new tab)) and 1 October 06:08 UTC (last (opens in a new tab)). NEAR Intents stopped services on 1 October (opens in a new tab), and NEAR Protocol said (opens in a new tab) the core protocol and NEAR token were not affected. Illia Polosukhin said (opens in a new tab) the funds were returned in full at 14:30 UTC on 2 October. Per the postmortem, the deposit-notification feature has been removed and the contract now pauses automatically if user balances exceed its holdings.