What happened
On April 29, 2026, the SWEAT token contract on NEAR was exploited for approximately 13.71 billion SWEAT, valued at about $3.5 million at the time. Multiple Sweat Foundation and top-holder accounts were drained, but the team restored external account balances after pausing the contract and coordinating with exchanges and liquidity partners.
The NEP-141 token contract did not enforce that only the token contract could call its ft_resolve_transfer refund callback, allowing an attacker to trigger full-balance refunds from victim accounts.
How it happened
The attacker called the publicly reachable transfer-refund callback directly through a custom drainer contract. Because the callback accepted attacker-controlled invocation and interpreted an empty return as zero tokens consumed, it refunded victims' full balances to the attacker without phishing, compromised keys, or user signatures.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
