According to NEAR Intents' post-incident report released by General Manager Alex Shevchenko on October 16, the cross-chain exchange protocol identified a $3.8 million vulnerability stemming from a faulty deposit notification function. Attackers exploited the flaw between September 29 and October 1, creating a contract that deliberately failed deposit notifications, allowing attackers to accumulate unsupported balances (termed "ghost funds") across 23 transactions and withdraw real tokens via Omni infrastructure. The attacker returned all funds within 36 hours of detection, and all affected users received full compensation. The settlement contract was paused on October 1 and resumed with fixes deployed on October 2; the notification feature was completely removed on October 7 after a second critical vulnerability was identified in the same function. A security researcher received a $300,000 bounty for discovering the subsequent flaw.
Disclaimer: This content is for informational purposes only and does not constitute investment advice or encourage the buying or selling of crypto assets. It is intended to provide information about industry developments and is not directly related to the services offered by Gate TR. Although information obtained from third-party sources has been carefully reviewed, Gate TR assumes no responsibility for any errors or omissions. Crypto assets involve high risks and may experience significant price fluctuations. Before making any investment decisions, you should assess your financial situation and risk tolerance, conduct your own research, and make decisions independently.
