$3.8M Gone: NEAR's Deposit Bug Postmortem Reveals the Exploit Nobody Caught in Time
A single deposit notification bug drained $3.8 million from NEAR Intents before the team could stop it, and the protocol's own fix is what opened the door.
NEAR's postmortem, published following the exploit, confirms that the vulnerability was tied directly to how the protocol handled deposit notifications. When a separate critical bug was flagged by a researcher, the team moved fast to remove deposit notifications entirely as a patch. That decision, made under pressure, inadvertently created the window attackers walked through. The $3.8 million was gone before the full scope of the exposure was understood.
What Actually Happened
This is the part most coverage is glossing over. The exploit was not the result of a sophisticated, months-long attack. It was opportunistic, triggered by a reactive security patch that introduced a new vulnerability while closing an old one. That is a pattern DeFi protocols have been repeating since 2020, and it keeps costing users real money.
NEAR says all affected users were made whole. That is meaningful, and credit where it is due, the team did not vanish or stonewall. The postmortem is detailed and the remediation appears genuine. But the reimbursement comes from somewhere, and protocols absorbing eight-figure losses to cover exploits cannot do that indefinitely.
The Deeper Problem
Deposit and withdrawal notification logic is foundational infrastructure in any DeFi protocol. It sits at the intersection of user funds and contract execution. When that layer has not just one but two critical bugs discovered in close succession, it signals something more systemic than a one-off oversight. It points to audit gaps, insufficient invariant testing, or a codebase that was scaled faster than its security architecture could support.
NEAR Intents is a relatively new product within the NEAR ecosystem, designed to abstract cross-chain complexity for users. The ambition is real. The demand for intent-based execution across chains is growing fast. But ambition without layered security review is exactly how protocols end up writing postmortems.
What to Watch
If you are holding funds in any intent-based or cross-chain DeFi protocol right now, this is the moment to check two things: whether that protocol has undergone multiple independent audits of its deposit and settlement logic, and whether it has a funded insurance or recovery mechanism if an exploit hits.
NEAR's price reaction will be the short-term signal to watch. If the community reads this postmortem as responsible disclosure and full recovery, the damage may be contained. If a second wave of scrutiny hits the broader Intents architecture, expect pressure on NEAR token and on the intent-based DeFi narrative more broadly.
The protocol survived this one. The question is whether the underlying codebase is clean enough to survive the next researcher who goes looking.