HOT Bridge / NEAR Intents

On 30 September 2026 an attacker exploited HOT Omni Bridge on NEAR by using a large pre-existing internal balance of a custom auxiliary token to request oversized refunds; the resulting burn event exceeded NEAR's 16,384-byte log limit, causing the resolver to fail and roll back internal burns while HOT had already refunded backing assets. This desynchronization allowed the attacker to withdraw USDT from HOT’s BSC treasury in multiple payouts totaling $3.865M; the Intents contract logic omission (not capping refunds to the deposited amount) was identified as the root cause and an upgrade to intents.near was later deployed to remediate the flaw.