2026-09-29 · record inc_0001 · updated 2026-10-19
NEAR Intents: ghost funds from a deposit notification bug
A failed third-party notification left unbacked credit in the intents.near ledger, and about 23 failed deposits became real withdrawals of roughly $3.8M.
NEAR Intents
NEARComponent: intents.near settlement contract, deposit notification feature
Event: Official statementRoot cause: Official statementLoss: Official statement
Current status
Funds reported returned; notification feature removed.
Timeline
- 2026-09-29 16:14 UTCFirst withdrawal of ghost funds.
- 2026-10-01 05:54 UTCLast withdrawal.
- 2026-10-01 08:33 UTCContract paused.
- 2026-10-07Second critical report on the same feature; feature removed that day.
- 2026-10-16Postmortem published.
Root cause
Per the postmortem, a deposit notification that failed on purpose refunded the tokens while the ledger kept the credit. The ledger then promised more than the contract held.
Basis: official post-mortem · verified by us against that source
Classes: Accounting and share-price errors, Business logic flaws
Impact: loss and recovery
Withdrawals of real tokens through the Omni bridge infrastructure against credit no tokens backed. Number of affected users not disclosed.
Reported loss
$3.8M
USD basis: Postmortem as reported by The Defiant.
Recovered or returned
$3.8M (full, claimed)
Postmortem says all funds were returned. Not independently verified.
Loss and recovery are separate figures. They are never netted, and amounts in different currencies are never added together.
Addresses and transactions
No addresses or transaction hashes have been verified for this record. We do not publish unverified hashes.
Public PoC metadata
No public PoC or reproduction entry is recorded for this incident.
Remediation and defensive indicators
- Feature removed; added a check that compares internal balances with held tokens, with automatic pause. (reported)
Defensive lessons from the class
- Write the invariant down and test it in every call order.
- Update every record in the same place a quantity changes.
- Model failure paths, not only success paths.
- Fuzz invariants, not only functions.
Sources
Official post-mortem
Alex Shevchenko, NEAR Intents: Postmortem NEAR Intents October 1 Exploit (X post)
Published 2026-10-16 · retrieved 2026-10-19 · ThreatWire did not read the original post; link is the author's profile.
Independent analysis
thecoding (Substack): Easily explaining the NEAR Intents exploit
retrieved 2026-10-19
Media report
The Defiant: NEAR Intents postmortem links $3.8M exploit to deposit bug
Published 2026-10-16 · retrieved 2026-10-19
Media report
The Crypto Times: NEAR Intents traces $3.8M exploit to smart contract deposit bug
Published 2026-10-17 · retrieved 2026-10-19
Media report
Coindaro: NEAR Intents exploit: postmortem blames deposit bug
retrieved 2026-10-19
- UNCX Vesting V2: share records and token balance made to disagreeShared class: Accounting and share-price errors
Read the full written analysis
Method, uncertainty and corrections
Still unknown
- Number of affected users
- Which token the 23 deposits used
- Attacker identity and return terms
Where sources disagree
- Duration of the incident is reported as 37 or about 40 hours depending on the start and end used.
- The first statement blamed Omni; the postmortem blames the contract.
Written by ThreatWire editorial. Facts attributed to the sources listed; figures are estimates and not independently verified unless marked on-chain. Published 2026-10-19, last updated 2026-10-19. Figures are estimates from public post-mortems and named analysts; not independently verified unless marked as confirmed on-chain.
No corrections recorded since publication.