Rekt - NEAR Intents - Rekt

What it is

Rekt's analysis of the 30 September to 1 October 2026 theft of 3,865,000 USDT from the HOT Bridge treasury on BNB Chain (0x233c…b4cd), the vault behind NEAR Intents on 11 chains. It combines Bitquery's fund trace with NEAR's public regression test. Together they give a partial root cause, and the page says the full exploit path is still undisclosed.

How it works

The BNB Chain locker does not compute balances. Per HOT Bridge documentation, it verifies an MPC-signed withdrawal instruction and an unused nonce, then pays. Entitlement is decided on NEAR, where the HOT OMNI Balance contract burns the omni-token and records the withdrawal.

flowchart LR
    A[NEAR side: balance and refund accounting] -->|MPC signature + nonce| B[BNB locker]
    B -->|pays if signature valid, nonce unused| C[Recipient]
    A -. flaw here .-> D[Authorization for 1.5M USDT after a 10 USDT deposit]
    D --> B

The attacker's withdrawals used signatures in the same form as ordinary ones. In all seven, the recipient submitted the transaction directly, while other payouts Unchained reviewed were submitted by a different address. HOT's design allows any account to submit a signed intent, so this is not itself a flaw.

NEAR's pull request "reproduce bug" added a refunded-amount check in mt_resolve_deposit. Its regression test describes a receiver with a large balance requesting a refund larger than its deposit. The resulting mt_burn refund event could exceed NEAR's log-length limit and make the callback fail.

An on-chain callback on intents.near carried 98 token/amount pairs. Its log message was 16,495 bytes against the 16,384-byte limit. The page says neither NEAR nor Bitquery explains how that failed callback became signed withdrawal authority.

Preconditions / Affected

NEAR says the bug was isolated to USDT on BSC. The page calls the regression test one reproduced failure mode and says it does not rule out other components. The affected route was HOT Bridge/HOT-Omni, not the separate Omni Bridge.

What to do

The page states these actions only:

• NEAR patched the contract side with the refunded-amount check, so a refund can never exceed its deposit.
• NEAR says further infrastructure fixes are underway.
• Illia Polosukhin said NEAR will add formal verification to its contract release process. The page notes this only checks code against a specification, not whether the specification is right.

The page flags one validation boundary a postmortem should cover. The earlier audit (Veridise, per the credit list) assumed the MPC network signs only valid operations, leaving validity "entirely" to the Validation SDK. It also noted the MPC service reads configuration from an out-of-scope external contract.

Caveats

• Timeline: the largest prior single payout in two days was under 400,000 USDT. Three withdrawals in under an hour (800,000, 1,200,000 and 1,500,000 USDT) exceeded it, and the vault kept paying for over six hours. NEAR's first statement came about 13 hours after the first large withdrawal. NEAR has not said when SHIELD detected the activity.
• Laundering: Bitquery traced 99% of the funds. 76% went to Bitcoin via Chainflip, THORChain and other routes, 21% to KuCoin deposit addresses, and 2% to XMR1 on Hyperliquid. About $822,000 went through NEAR Intents' own service during the drain, including 750 BNB into the vault being drained.
• Recovery: 34.58927254 BTC reached NEAR's recovery address on 2 October. NEAR says the funds were returned in full and closed the investigation.
• Gaps: no asset-by-asset reconciliation was published for the KuCoin funds (about $802,000) or the XMR1. The terms of the return and any bounty are undisclosed.
• Report: NEAR promised a detailed report. As of 8 October none had been published.
• Bounty rules: the NEAR Intents Bridges page lists a $300,000 critical maximum in its reward table and $100,000 in its written rules. Its 10% formula would give about $386,500 on this loss.
• Authorship: Rekt is an anonymous-author platform. Its inferences, such as the bounty comparison, are the author's.