NEAR Intents Recovers $3.8 Million Following Security Incident
Written with artificial intelligence.
NEAR Intents reported on October 1 that a vulnerability in its smart contract allowed attackers to generate a false balance of approximately $3.8 million through failed deposit transactions. The funds were fully recovered within 36 hours of identification of the issue, which was attributed to the smart contract rather than the Omni cross-chain infrastructure.
Overview of the Security Incident
On October 1, NEAR Intents released a report detailing a security incident involving a vulnerability in its smart contract related to interactions with a third-party contract. Attackers exploited this vulnerability by utilizing the refund mechanism that triggers after a failed call, which allowed them to generate a false balance of about $3.8 million through 23 failed deposit transactions. The funds were subsequently withdrawn using the Omni cross-chain infrastructure.
Rapid Recovery Efforts
Importantly, the vulnerability was identified as an issue within the NEAR Intents contract itself, not a flaw in the Omni infrastructure. Following the discovery of the exploit, NEAR Intents acted swiftly and managed to recover all funds within 36 hours.
Measures Implemented
In response to the incident, NEAR Intents has taken several precautionary measures:
- Removed the deposit notification feature associated with the vulnerability
- Implemented abnormal balance monitoring
- Introduced an automatic suspension mechanism for suspicious activities
Additionally, the team rewarded a researcher with $300,000 for reporting a serious vulnerability in the same feature on October 7. The system is now reported to be operating normally.