{"id":615349,"date":"2026-06-16T17:58:54","date_gmt":"2026-06-16T17:58:54","guid":{"rendered":"https:\/\/Blockchain.News\/news\/fireblocks-mitigates-sweat-hot-zero-day-near"},"modified":"2026-06-16T17:58:54","modified_gmt":"2026-06-16T17:58:54","slug":"fireblocks-thwarts-sweat-and-hot-exploits-on-near-protecting-millions","status":"publish","type":"post","link":"https:\/\/e-bitco.in\/index.php\/2026\/06\/16\/fireblocks-thwarts-sweat-and-hot-exploits-on-near-protecting-millions\/","title":{"rendered":"Fireblocks Thwarts SWEAT and HOT Exploits on NEAR, Protecting Millions"},"content":{"rendered":"
\n

Ted Hisokawa<\/a> Jun 16, 2026 17:58<\/span> <\/p>\n

Fireblocks detected and mitigated critical zero-day flaws in SWEAT and HOT contracts on NEAR, safeguarding 22M users from potential multi-million dollar losses.<\/p>\n

\"Fireblocks <\/a> <\/figure>\n

Fireblocks has revealed its role in identifying and mitigating two critical zero-day vulnerabilities that could have cost NEAR Protocol users millions of dollars. The flaws were discovered in the contracts of SWEAT, a token powering the Sweat Economy ecosystem, and HOT, a Web3 governance token with over 22 million holders.<\/p>\n

In late April 2026, Fireblocks’ blockchain monitoring flagged unusual transactions on NEAR involving SWEAT tokens. Attackers were draining wallets without requiring private keys, phishing links, or user signatures. One victim alone lost 8.5 million SWEAT tokens in a single exploit, valued at $170,000 to $250,000. The problem stemmed from a missing security guard in the ft_resolve_transfer<\/code> callback function, which refunded token balances without verifying the caller\u2019s identity.<\/p>\n

The exploit leveraged NEAR\u2019s token standard (NEP-141), which uses ft_resolve_transfer<\/code> to refund unused balances. In SWEAT\u2019s implementation, this function lacked NEAR’s #[private]<\/code> macro, leaving it exposed to public calls. Attackers exploited the flaw by crafting a malicious contract that tricked the system into issuing refunds directly to their wallets. The result: millions of tokens drained from victims’ accounts.<\/p>\n

HOT Contract Flaw Uncovered<\/h2>\n

After patching SWEAT\u2019s vulnerability, Fireblocks launched a broader investigation across NEAR\u2019s ecosystem. Their proactive search uncovered the same flaw in HOT, a governance token with over 22 million holders. The potential consequences were severe\u2014attackers could have exploited the same \u201cempty refund\u201d logic to mint unlimited HOT tokens or drain user balances. Fireblocks reported the issue to HOT’s maintainers, who deployed a patch the same day.<\/p>\n

The stakes were enormous. HOT\u2019s ecosystem supports over 35 million users and hundreds of millions of token transfers. A successful exploit could have triggered massive financial losses and eroded confidence in NEAR\u2019s infrastructure.<\/p>\n

Broader Implications for Web3 Security<\/h2>\n

Fireblocks’ swift action highlights the rising stakes in blockchain security. As AI tools accelerate the pace of code analysis, attackers can identify vulnerabilities in live contracts faster than ever. The same tools, however, can empower defenders to find and fix flaws before exploits occur.<\/p>\n

For protocols like SWEAT, the consequences of such vulnerabilities are not just financial. SWEAT is a cornerstone of Sweat Economy, a move-to-earn ecosystem that incentivizes physical activity through token rewards. The April 2026 exploit, which drained 13.71 billion SWEAT tokens (65% of supply), underscored the need for robust contract security. Although user balances were restored, the incident highlighted the fragility of token ecosystems reliant on smart contract integrity.<\/p>\n

As of June 16, 2026, SWEAT trades at $0.00071807, reflecting a 0.04481% decline in the last 24 hours. Its market cap stands at $8.93 million, underscoring the token’s recovery efforts post-exploit. HOT, meanwhile, avoided a similar catastrophe thanks to Fireblocks\u2019 intervention, preserving its ecosystem\u2019s stability.<\/p>\n

For Web3 builders, the lesson is clear: security cannot be an afterthought. As the arms race between attackers and defenders intensifies, proactive measures and rigorous audits are critical to safeguarding user assets and ecosystem trust.<\/p>\n

Image source: Shutterstock<\/i><\/span> Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Ted Hisokawa Jun 16, 2026 17:58 Fireblocks detected and mitigated critical zero-day flaws in SWEAT and HOT contracts on NEAR, safeguarding 22M users from potential multi-million dollar losses. Fireblocks has revealed its role in identifying and mitigating two critical zero-day vulnerabilities that could have cost NEAR Protocol users millions of dollars. The flaws were discovered […]<\/p>\n","protected":false},"author":1,"featured_media":615350,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[12193,25671,2329,25,25670,14054],"class_list":{"0":"post-615349","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-blockchain","8":"tag-crypto-security","9":"tag-hot-token","10":"tag-near-protocol","11":"tag-news","12":"tag-sweat-token","13":"tag-zero-day-exploit"},"_links":{"self":[{"href":"https:\/\/e-bitco.in\/index.php\/wp-json\/wp\/v2\/posts\/615349","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/e-bitco.in\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/e-bitco.in\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/e-bitco.in\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/e-bitco.in\/index.php\/wp-json\/wp\/v2\/comments?post=615349"}],"version-history":[{"count":0,"href":"https:\/\/e-bitco.in\/index.php\/wp-json\/wp\/v2\/posts\/615349\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/e-bitco.in\/index.php\/wp-json\/wp\/v2\/media\/615350"}],"wp:attachment":[{"href":"https:\/\/e-bitco.in\/index.php\/wp-json\/wp\/v2\/media?parent=615349"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/e-bitco.in\/index.php\/wp-json\/wp\/v2\/categories?post=615349"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/e-bitco.in\/index.php\/wp-json\/wp\/v2\/tags?post=615349"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}