NEAR Intents: post-mortem on ~$3.8M ghost-balance deposit bug; funds returned
Update
Post-mortem: deposit-refund ghost balances; auto-pause added
17 Oct coverage of the 16 Oct post-mortem from GM Alex Shevchenko: the fault was in the Intents contract, not Omni bridge infrastructure.
8M of unbacked balances were built over 23 failed deposits and withdrawn.
Monitoring had compared origin-chain balances with NEAR-side token totals, but not users' recorded balances against tokens the contract actually held.
That gap is now monitored with an automatic pause if the two diverge.
A similar issue was fixed via bounty in January; on 7 Oct another critical bug in the same feature earned a $300K HackenProof payout and the feature was removed.
Recovery and user make-whole unchanged from earlier updates.
Update
Return was partly Monero; conversion still in process
59 BTC, about 78%). The remainder (analyst estimates around $850K) came back in Monero at the attacker's request.
Converting it is still in process, and counterparties are asking about source of funds. The team had already refilled contracts from its own money, so users stay covered either way.
A negotiated full return is not finished until every rail is usable cash.
Update
CertiK: refund-cap fix in public code was missing on-chain
09 Oct Grok window: CertiK traces the loss to a deposit-credit versus HOT Bridge refund mismatch. 865M across five payouts).
A refund-limit fix that sat in the public repository since March 2026 does not appear in the deployed contract, per NEAR's own October commit that reflects deployed state. 4 shipped about 03 Oct.
Rekt confirms full recovery and says the full failure story is still unclear. Recovery already on the card.
Update
Full ~$3.8M returned; investigation stopped
03 Oct Grok window: GM said funds were sent back in full and the probe stopped before the Oct 4 deadline.
59 BTC into the published Bitcoin recovery address, with remaining value via other routes; Shevchenko acknowledged that split. A BNB Chain return message urged bug bounties.
SHIELD identification remains team-stated. Technical post-mortem still open.
01 Oct 2026: NEAR Intents halted after a bug in how Omni deposit and withdrawal infrastructure talked to the Intents smart contract. 8M.
Team patched the contract-side hole, pledged full compensation, and on 02 Oct gave a 48-hour return window. 8M was sent back in full and the team stopped the investigation before the Oct 4 deadline.
59 BTC into a published Bitcoin recovery address, with the remainder via other routes; a BNB Chain tx from a labeled exploiter address carried a return apology message.
NEAR co-founder said identification used SHIELD plus detective work; treat that path as team-stated. Full technical post-mortem still not published. Separate from the earlier Bitget-linked NEAR Intents SHIELD deny story.
Research snapshot from CryptoTimes, The Block, SlowMist Hacked, and related press.
369 take
Users were covered because NEAR Intents refilled from its own money. Builder lesson: reconcile user liabilities against tokens the contract actually holds, not only chain-vs-chain totals.
A negotiated return partly delivered in Monero is still not the same as settled Bitcoin until conversion finishes. Pulse lesson for Liberty-class intent on-ramps: size exposure as hot custody risk.
Sources
- CryptoTimes. Full ~$3.8M returned; probe stopped
- The Block. NEAR Intents halts after ~$3.8M; full compensation pledged
- SlowMist Hacked. NEAR Intents row (~$3.8M, 2026-10-01)
- Cointelegraph. Identified attacker; 48-hour return window
- Decrypt. Days after Bitget-hacker deny headline
- CertiK. HOT Bridge / NEAR Intents analysis
- Rekt. NEAR Intents
- Altcoin Buzz. Bitcoin and Monero return split
- Alex Shevchenko. Post-mortem
- CryptoTimes. Post-mortem write-up