NEAR Intents incident, 2026-10-01
What happened to NEAR Intents?
Between 29 September and 1 October 2026 an attacker used a bug in the NEAR Intents settlement contract (intents.near) to create about $3.8M of unbacked “ghost” balances and withdraw real tokens via Omni. NEAR Intents paused on 1 October; the exploiter returned all funds about a day later, and users were made whole.
Sources: CoinDeskThe Crypto TimesThe Defiant (via cryptonews.net)DefiLlama
Key facts
- Date (UTC)
- · withdrawals ran from 29 Sep 16:14 to 1 Oct 05:54 UTC; detected and paused on 1 Oct
- Protocol
- NEAR Intents — the intents.near settlement contract and its Omni deposit/withdrawal infrastructure
- Reported loss
- ≈ $3.8M withdrawn; all of it returned by the exploiter CoinDeskThe Crypto TimesThe Defiant (via cryptonews.net)
- Root cause
- Contract bug — a deposit-notification feature kept ledger credit for deposits whose tokens had been refunded, creating unbacked balances The Crypto TimesThe Defiant (via cryptonews.net)
- Chains
- NEAR, BNB Chain, other Omni-connected chains
- Recovery
- Funds returned
- Official post-mortem
- Postmortem: NEAR Intents October 1 Exploit
Timeline
All dates and times in UTC.
- 2026-09-29 16:14 — First withdrawal against unbacked balances. The Crypto Times
- 2026-10-01 05:54 — Last attacker withdrawal (23 failed deposit transactions in total had created ≈ $3.8M of ghost balances). The Crypto Times
- 2026-10-01 08:04 — Team identifies the withdrawal issue; contract paused 29 minutes later. The Crypto Times
- 2026-10-01 — Contract unpaused later the same day; affected routes reopened gradually. The Defiant (via cryptonews.net)
- 2026-10-02 — Exploiter returns all assets. CoinDesk
- 2026-10-02 20:31 — Contract-side fix goes live: ctl-intents.near upgrades intents.near to release 0.4.4 (transaction FPLaCtdy…). Nearblocks
- 2026-10-07 — A further critical bug report in the same deposit-notification feature; the feature is removed (researcher paid $300,000). The Defiant (via cryptonews.net)
- 2026-10-16 — Post-mortem by NEAR Intents general manager Alex Shevchenko, published as an article on X. NEAR Intents (Alex Shevchenko)
Where did the funds go, and was anything recovered?
The exploiter was identified and contacted, and returned all stolen assets about a day after the pause (CoinDesk). Per the 16 October post-mortem, everything was recovered within 36 hours of detection; NEAR Intents had already replenished its contracts from its own funds, and part of the returned value arrived as Bitcoin and Monero (The Crypto Times).
Before the return, investigator ZachXBT traced funds from a BNB Chain hot wallet to KuCoin and into bitcoin (as reported by CoinDesk).
Which routes and bridges were affected?
The attacker withdrew real tokens through Omni, NEAR Intents' cross-chain deposit/withdrawal layer; outflows were first seen from a BNB Chain hot wallet. While paused, the status page listed deposits/withdrawals unavailable on BNB Smart Chain, Polygon, TON, Optimism, Avalanche, Stellar, Monad, X Layer, ADI, Scroll and Plasma (CoinDesk). Swaps through the 1Click API and partner front-ends that route via NEAR Intents were halted on 1 October and reopened route by route.
Our reviews of the bridges involved: NEAR Intents
Why did it happen?
The intents.near contract keeps an internal ledger of what each user deposited. A convenience feature let a deposit also notify a third-party contract. On NEAR, cross-contract calls are asynchronous: if the follow-up call fails, the token contract refunds the tokens, and every contract involved has to undo its own state. Here the Intents contract kept the ledger credit even though the tokens went back. The attacker deployed a contract designed to fail those notifications and, over 23 failed deposits, built up about $3.8M of balances backed by nothing, then withdrew real assets through Omni (The Crypto Times).
The bug sat for almost 40 hours because monitoring compared origin-chain balances with token balances on NEAR, but never compared the sum of users' internal balances with what the contract actually held — the one invariant that would have caught it. The feature had a bug-bounty history in January and again on 7 October, which is a signal that optional complexity on a settlement contract carries real cost.
Early statements blamed an interaction between Omni and the contract; the post-mortem says it was a contract bug, not an Omni bug. We follow the post-mortem and note the difference.
What should users have done then, and what should they do now?
At the time
Users had little to do: funds in flight were protected by the pause and the protocol pre-funded the shortfall. The sensible actions were to stop sending new deposits to affected chains while the status page showed them down, and not to chase "refund" links shared in replies — impersonation scams usually follow incidents like this.
Now
The feature is gone and an automatic pause now fires if internal balances and contract holdings diverge. When choosing any intent-based route, check that the protocol publishes a status page and a dated post-mortem, and size transfers so that a one-day pause would not hurt you. Our NEAR Intents quotes come from the 1Click API; see the disclosure above.
Sources
7 independent publishers. Links checked on the date shown.
- NEAR Intents hit by $3.8 million exploit as crypto's rough year of hacks continues — CoinDesk · Media · checked
- NEAR Intents Traces $3.8M Exploit to Smart Contract Deposit Bug — The Crypto Times · Media · checked
- NEAR Intents Postmortem Links $3.8 Million Exploit to Deposit Bug — The Defiant (via cryptonews.net) · Media · checked
- DefiLlama Hacks — NEAR Intents, 2026 — DefiLlama · Database · checked
- Postmortem: NEAR Intents October 1 Exploit — NEAR Intents (Alex Shevchenko) · Official · checked
- Transaction FPLaCtdy… — ctl-intents.near upgrades intents.near (2 Oct 2026 20:31:41 UTC) — Nearblocks · Database · checked
- HOT Bridge / NEAR Intents — incident analysis — CertiK · Security firm · checked
How do I cite this page?
Burn, A. / upswap.io (2026). NEAR Intents incident (2026-10-01). Updated 2026-10-24. https://upswap.io/incidents/near-intents-2026#summary. CC BY 4.0. Accessed ____.
Stable anchors: #summary #facts #timeline #funds #affected #analysis #then #now #sources #cite