According to CoinMeta, NEAR and intents released a post-event report disclosing that the withdrawal of $3.8 million in assets was due to a flaw in the deposit notification function. Attackers exploited this flaw to generate false balances and then withdrew real tokens between September 29th and October 1st. NEAR, the CEO of intents, stated that the vulnerability existed in the NEAR and intents contracts. The attackers returned all the funds within 36 hours of the vulnerability being discovered, and the affected users have received full compensation. The team has since improved their monitoring mechanisms and removed the vulnerable functionality, and another security researcher received a reward of $300,000.