NEAR Intents released a post-release report, indicating that the vulnerability involving $3.8 million stemmed from flaws in the deposit notification mechanism.

Cross-chain swap protocol NEAR Intents published a post-mortem report on October 16, authored by General Manager Alex Shevchenko. The report states that before the protocol was shut down on October 1, an attacker exploited a flaw in the deposit notification function to extract $3.8 million. The protocol's public settlement contract deployed on NEAR maintains an internal ledger of deposited tokens, while withdrawals move tokens out via a cross-chain bridge. The deposit notification function notifies third-party contracts when tokens are deposited. The attacker created a contract designed to make the notification fail, causing the token contract to refund the deposit while NEAR Intents still retained the corresponding balance. Within 36 hours of detection, the attacker returned all funds, and all affected users have been fully compensated.