NEAR Intents Pins Its $3.8M Loss on 23 Failed Deposit Calls

NEAR Intents published its postmortem on the September exploit on Thursday, and it moves the fault. The loss came out of the protocol's own Intents contract, not the Omni cross-chain layer the team named when the incident broke on 1 October. General manager Alex Shevchenko wrote that a deposit-notification feature let an attacker hold ledger credit for deposits the token contract had already refunded, and that 23 failed transactions were enough to build roughly $3.8 million of balances with nothing behind them. He calls them ghost funds. All of it came back.

How a failed call left a credit behind

The feature was a courtesy. When tokens arrived, the Intents contract would notify a third-party contract that a deposit had landed. The attacker deployed a NEAR contract built to make those notifications fail. A failed call sent the deposited tokens back to their sender, while the deposit record stayed on the Intents ledger, so the contract read itself as holding tokens it had returned. Real tokens were then withdrawn against the fake balances and moved to other chains through Omni. Shevchenko points at NEAR's asynchronous runtime, where a contract has to handle the failure of a call it made in a later step, as the part developers get wrong.

"The feature had a history of bug reports, all in the gap between its two steps," Shevchenko wrote.

Forty hours without the check that would have caught it

Monitoring compared balances on the origin chains against total token balances on NEAR. It never compared what users were recorded as owning against what the Intents contract actually held. That is the comparison this attack breaks, and its absence is the reason the unbacked balances sat undetected for close to 40 hours. The Crypto Times, the only outlet swept carrying the postmortem's clock times, has withdrawals running from 16:14 UTC on 29 September to 05:54 UTC on 1 October, the team spotting the withdrawal problem at 08:04 UTC that morning, and the contract paused 29 minutes later. A fix reached mainnet the next day. The new monitoring makes the missing comparison and pauses the contract by itself when the two sides disagree.

The same feature had been reported twice before

A bug bounty report in January flagged a similar problem with third-party contract calls. The team fixed it in two days and nobody exploited it. On 7 October, with the money already gone and returned, a second critical report found another issue in the same deposit-notification path, and NEAR Intents deleted the feature that day. Researcher Rohan Ganapa was paid $300,000 for the October finding through the protocol's HackenProof programme, a figure two accounts carry. Deletion is the one fix that cannot regress. A comparable case sits in this desk's archive: Autheo's 19 million unbacked tokens came from a contract fault that went unnoticed until the supply moved, and THEO fell 92%.

What the figures still do not settle

The amount has three readings. Most accounts, this desk's 2 October piece included, put it at about $3.8 million; Crypto Briefing has $3.865 million in USDT; Unchained, working from BNB Chain data on 1 October, had about 3.87 million USDT leaving a contract over roughly six hours. They do not reconcile and no account addresses the others. The recovery window is loose in the same way. The postmortem says all funds were back within 36 hours of detection, while Crypto Briefing counts 24 hours from the moment Shevchenko named the attacker in public and set a deadline. Both can be true of the same money. The attacker's identity is still undisclosed, and no account establishes whether any user finished out of pocket. Bitget's postmortem on its $388 million theft arrived weeks after the event; this one took a fortnight, and the line worth keeping from it is about the gap between two steps of a single call.