The report puts the withdrawals across about 38 hours from September 29 and says monitoring never compared user balances against the tokens the contract actually held. It places the flaw in the NEAR Intents contract rather than the Omni infrastructure the project named on October 1.
NEAR Intents published a post-mortem on October 16 that puts the cause of its roughly $3.8 million loss in its own settlement contract rather than in the cross-chain infrastructure the project pointed at when the incident broke. The account came from general manager Alex Shevchenko and was reported by The Crypto Times, DeFiPrime. It is the detailed report the protocol promised within days of the October 1 halt and delivered 15 days later.
The fault sat in a deposit-notification feature, which told a third-party contract on NEAR when tokens had arrived. According to the report, the attacker deployed a receiver contract built to make that notification call fail. The token contract then refunded the deposit, while the Intents contract kept the matching credit on its internal ledger. Twenty-three failed deposit transactions produced about $3.8 million of balances with no tokens behind them, entries the report calls ghost funds, and the attacker withdrew real tokens against them before moving the proceeds to another chain through Omni.
That is a narrower cause than the one the project gave at the time. Its October 1 statement blamed “a bug in the Omni deposit and withdrawal infrastructure interaction with NEAR Intents smart contract,” wording that spread the fault across two components. The post-mortem still has the money leaving through Omni, but puts the accounting error in the Intents contract alone.
The report also supplies the timeline the project did not publish at the time. Withdrawals against the fabricated balances began at 16:14 UTC on September 29 and ended at 05:54 UTC on October 1, a span of about 38 hours. The team identified the withdrawal problem at 08:04 UTC that morning, paused the contract at 08:33 and put the near.com front end into maintenance seven minutes later. The contract resumed at 11:20 UTC with affected routes returning gradually, and the front end came back at 14:00. The statement announcing the halt went out at 12:53 UTC, after the contract had already restarted.
Roughly 40 hours separated the first withdrawal from detection, and the report attributes that to what the monitoring measured. Balances on the origin chains were compared with token balances on the NEAR side, but nothing compared the user balances held inside Intents with the tokens the contract itself held. That comparison would have shown credits with nothing behind them, and the team says it has since added it, with an automatic pause when the two sides stop matching. The report also says global pauses have been separated from route-level controls. On October 1 the restart left deposits and withdrawals down on eleven networks while the rest of the protocol came back.
The 38-hour window is wider than the picture available when the incident broke. Unchained, reading on-chain records, placed the start of the outflows on the evening of September 30 and counted about 3.87 million USDT leaving one BNB Chain treasury address over roughly six hours. The post-mortem's window opens about a day earlier. The two figures measure different things, withdrawals against ghost balances on one side and movement out of a single address on a single chain on the other, so neither corrects the other. What the project's own account adds is how long the contract went on crediting deposits it had already refunded.
The money came back from the attacker rather than from the protocol. Shevchenko posted on October 2 that the team had identified the person responsible, gave 48 hours to return the funds and listed Bitcoin, BNB Chain and Solana addresses to send them to, without offering evidence for the identification. The funds were returned that day, within about 36 hours of detection, and the report says affected users were compensated in full. A fix shipped at 20:31 UTC on October 2 and contract-side deposits reopened seven minutes after it. Where an attacker does not cooperate, the outcome for users is different: Drift's recovery pool paid about a cent on every dollar taken in its April exploit.
The feature itself is gone. A second critical report on the same deposit-notification path on October 7 led the team to remove it rather than patch it again, and the researcher who filed that report received a $300,000 bounty. The post-mortem says formal verification and further work on SHIELD, the project's security layer, are continuing, and gives no dates for either.
