News linked to both this project and an event.
In a postmortem article published by Alex Shevchenko (@AlexAuroraDev), lead of NEAR Intents, a vulnerability was identified in the NEAR Intents contract's deposit notification mechanism when interacting with third-party contracts. The attacker deployed a contract that caused the notification call to fail, triggering the token contract to refund the deposits while the NEAR Intents contract retained the deposit records. Through 23 failed deposit transactions, the attacker generated approximately $3.8 million in "phantom funds," which were subsequently withdrawn to external chains via Omni infrastructure. This vulnerability resided in the NEAR Intents contract rather than in the Omni infrastructure. The timeline indicates the attack occurred between September 29 and October 1. The team detected withdrawal anomalies on October 1 and paused the contract within 29 minutes. Thanks to collaboration between the SHIELD security layer, on-chain tracking efforts, and industry security researchers, the attacker fully returned the funds on October 2, and all affected users have been compensated. The postmortem highlighted that existing monitoring only tracked discrepancies between aggregate token balances on the source chain versus NEAR, failing to monitor the mismatch between total user balances and contract token balances. This oversight allowed the attack to proceed undetected for several days. For remediation, the team has completely disabled the deposit notification functionality and implemented new monitoring for discrepancies between total user balances and contract balances. If this invariant is violated, the contract will automatically pause. On October 7, white hat research
Odaily reports: Cross-chain swap service Near Intents announced that the $3.8 million in funds stolen in a previous exploit has been fully returned, and the team has closed its investigation. Near Intents General Manager Alex Shevchenko had previously issued a 48-hour return deadline to the attacker, providing Bitcoin, BNB, Ethereum, and Solana addresses.The attacker acknowledged wrongdoing in an on-chain message, stating that all funds had been returned and urging others to report issues through the bug bounty program. The incident stemmed from a vulnerability in the interaction between its Omni deposit and withdrawal layer and the main smart contract. Near Intents had suspended services and promised full compensation to users. (Decrypt)
According to Cointelegraph, Alex Shevchenko, General Manager of NEAR Intents, stated that the team has identified the hackers behind the previous security incident and given them a 48-hour deadline to return the stolen funds through a "responsible disclosure." NEAR Intents previously suspended its services due to a vulnerability in the interaction between the Omni deposit and withdrawal infrastructure and its smart contracts. Initial investigations revealed that approximately $3.8 million in user funds were stolen in the incident, and the team has committed to fully compensating affected users. On-chain detective ZachXBT stated that the stolen funds were subsequently transferred to KuCoin and cross-chain converted into Bitcoin.
Odaily News: NEAR Intents has stated that it has identified the attacker responsible for the loss of user funds and has demanded the return of $3.8 million within 48 hours through a "responsible disclosure" mechanism, after which the window will be closed.NEAR Intents suspended services on Thursday after discovering a vulnerability in the interaction between the Omni deposit and withdrawal infrastructure and its smart contracts. A preliminary investigation showed that the attack resulted in the theft of $3.8 million in user funds, and the platform has committed to fully compensating affected users.On-chain investigator ZachXBT disclosed that the related funds were transferred to the KuCoin exchange and subsequently bridged to Bitcoin. (Cointelegraph)
NEAR Intents stated that the vulnerability involved flaws in the Omni deposit and withdrawal infrastructure and smart contract interactions. The issue has been fixed, and the team has committed to full compensation.