NEAR Intents has published a postmortem on a security incident, reporting that approximately $3.8 million in funds has been fully recovered. The money is back, but that alone doesn’t prove that similar vulnerabilities have been completely addressed.
According to public discussions, the issue occurred after a deposit notification failed: the tokens were returned, but the system’s internal balance still increased. Someone then exploited the fictitious balance to withdraw assets cross-chain. Details of this vulnerability path currently come mainly from a single account and still need to be checked against the original postmortem; the recovery of the funds, however, has been confirmed by other public reports.
Other accounts also say the team has removed the feature involved and added balance checks and an automatic pause mechanism. What remains to be verified is whether these changes cover similar abnormal deposit flows, and whether there are verifiable records of compensation for affected users.
Should the full recovery of the funds be seen as a case brought to a proper close—or does it instead show that the market had underestimated the accounting risks of intent-based trading?
According to public discussions, the issue occurred after a deposit notification failed: the tokens were returned, but the system’s internal balance still increased. Someone then exploited the fictitious balance to withdraw assets cross-chain. Details of this vulnerability path currently come mainly from a single account and still need to be checked against the original postmortem; the recovery of the funds, however, has been confirmed by other public reports.
Other accounts also say the team has removed the feature involved and added balance checks and an automatic pause mechanism. What remains to be verified is whether these changes cover similar abnormal deposit flows, and whether there are verifiable records of compensation for affected users.
Should the full recovery of the funds be seen as a case brought to a proper close—or does it instead show that the market had underestimated the accounting risks of intent-based trading?