According to CoinMeta, NEAR and intents released a security incident review report for October 1st, disclosing a vulnerability in their smart contracts during the token deposit process when calling third-party contracts. Attackers exploited the refund mechanism after failed calls, allowing funds to be returned while the deposits were still recorded. Through 23 failed deposit transactions, they created a false balance of approximately $3.8 million, which was then withdrawn using omni's cross-chain infrastructure. The team confirmed that the vulnerability existed in the NEAR and intents contracts, rather than in the omni infrastructure. After on-chain tracking and negotiations with the attackers, all $3.8 million was recovered within 36 hours of the issue being discovered. The team has removed the relevant deposit notification function, added abnormal balance monitoring and an automatic suspension mechanism, and paid a $300,000 bounty to the researcher who reported another serious vulnerability in the same function on October 7th.