Fireblocks identified a critical vulnerability in the NEAR SWEAT token contract and proactively discovered the same flaw in the HOT token before exploitation. An active mainnet attacker was silently draining millions through an unguarded callback function affecting 22 million NEAR users.