Root Cause
NEAR Intents operates a cross-chain intent settlement layer that accepts deposits across multiple chains and tracks balances in its own ledger. The exploit targeted a smart contract deposit bug in the cross-chain settlement contracts — specifically, the attacker could inflate their on-chain balance by exploiting how the contract validated and credited incoming deposits.
Early reports attributed the root cause to an Omni bridge integration bug, but NEAR Intents' own postmortem (published October 16, 2026) placed the flaw directly in its smart contract code, not in Omni. The full postmortem technical details have not been independently verified at the time of this writing.
The attack vector was consistent with balance inflation via manipulated cross-chain message validation, where a deposit message could be submitted in a way that credited the attacker's account more than the actual deposited amount.
// Attack flow (inferred from on-chain activity):
// 1. Fund wallet with minimal USDT (test: 10 USDT)
// 2. Submit crafted deposit message that inflates credited balance
// 3. Withdraw inflated balance from BNB Chain vault
// Repeat across 5 major drain transactions
Attack Steps
| Step | Timestamp (UTC) | Action |
|---|---|---|
| 1 | Sept 30, ~19:40 | Two small test withdrawals to probe the vulnerability |
| 2 | Sept 30, 19:54 | First major drain transaction |
| 3 | Oct 1, ~02:08 | Final drain transaction; ~$3.865M total removed |
| 4 | Oct 1, ~08:53 | NEAR Intents discloses exploit publicly; flaw patched within 1 hour |
| 5 | Oct 2 | Attacker returns all $3.865M in full, ahead of 48-hour deadline |
Impact
- Total loss: ~$3.865M USDT from BNB Chain vault
- Net loss: $0 (full recovery after attacker return)
- Chains paused: BNB Chain, Polygon, TON, Optimism, Avalanche, Stellar, Monad, X Layer, ADI, Scroll, Plasma
- On-chain fund tracking (Bitquery): ~34.69 BTC distributed across 4 wallets; ~$802K routed through KuCoin; a slice swapped via NEAR Intents itself
- NEAR token impact: ~7.5% price drop at time of disclosure
Lessons for Auditors
- Cross-chain message validation: Any contract that credits a user's balance based on a cross-chain message must validate the deposited amount at the destination chain — not rely solely on the message payload from the source. Amount fields in bridge messages are a classic inflation vector.
- Separation of accounting from bridging: When a protocol adds its own ledger on top of a bridge, the join between the bridge's confirmed deposit event and the protocol's credit function must be carefully guarded. Race conditions or replay possibilities are dangerous.
- Small test transactions as an attack signal: The two sub-threshold test withdrawals prior to the main drain are a known attacker pattern. On-chain monitoring should alert on repeated sub-threshold withdrawal attempts from a new address before significant withdrawals occur.
- Attribution clarity in postmortems: The initial public attribution to Omni was later corrected by the protocol's own postmortem. For auditors, this underscores the importance of reviewing the full call stack across all cross-chain components rather than assuming a third-party bridge is the failure point.