Foresight News reports that cross-chain swap protocol NEAR Intents has published a postmortem on a security incident, revealing that the earlier withdrawal of $3.8 million worth of assets was caused by a flaw in its deposit notification feature. The attacker created smart contracts designed to make notifications fail, causing deposited tokens to be returned while the protocol’s internal ledger still recorded the corresponding balances. According to the report, the attacker generated $3.8 million in fictitious, unbacked balances through 23 failed deposit transactions, then withdrew real tokens between September 29 and October 1 and transferred them to other blockchains via the Omni infrastructure.

NEAR Intents stated that the attacker returned all funds within 36 hours of the vulnerability being discovered, and all affected users have been fully compensated. The team has improved its balance monitoring mechanisms and completely removed the vulnerable feature on October 7. In addition, another security researcher who discovered a related critical vulnerability received a $300,000 reward.