Sweat halts SWEAT token after $3.5M NEAR exploit

At about 13:36 UTC, an attacker used a vulnerability in the NEAR-based SWEAT token contract to transfer tokens from the top 100 holder accounts. A crypto security firm flagged the incident and noted multiple Sweat Foundation accounts were drained within a 30-second window.

At the exploit’s peak the attacker controlled roughly 13.71 billion SWEAT, about 65% of the total supply, valued at about $3.5 million at the time. Sweat paused the token contract to stop further withdrawals and contacted platforms the attacker was using to liquidate funds.

Centralized exchange MEXC froze the attacker’s account after being contacted by the team. Near-based on-chain liquidity provider Rhea paused SWEAT trading, limiting the attacker’s ability to move or cash out the tokens.

Sweat confirmed that all external account balances have been fully restored and that operations have returned to normal. The project plans to file an incident report with relevant law enforcement agencies and to perform a forensic analysis and publish a post-mortem on the attack.

Sweat, also known as Sweat Economy, is a move-to-earn application on the NEAR blockchain that issues tokens as rewards for walking. The team’s rapid pause of the contract and coordination with exchanges and a liquidity provider prevented further token movement and supported the restoration of user balances.

In a post on X, the team wrote, “We deeply appreciate the support and advice from the community that helped us to resolve this quickly.” The incident follows several large DeFi breaches in recent weeks that have prompted coordinated responses across the sector.