Sweat Economy

What happened

On 29 April 2026 an attacker exploited a refund-logic bug in the SWEAT token contract on NEAR, draining about 13.71 billion tokens (roughly 65% of supply, worth up to $3.5 million) in around 30 seconds.

The contract was missing an access-restriction macro: the attacker chained a no-op call returning empty bytes into ft_resolve_transfer, which the contract interpreted as 'receiver consumed zero tokens' and refunded victims' entire balances to the attacker. The team paused the contract, MEXC froze the attacker's account and Rhea Finance halted SWEAT trading; the team subsequently restored all external user balances and deployed a patched contract.