The cracked shield. NEAR Intents lost $3.8 million in exploitation. This forced the cutting of deposits and withdrawals on eleven networks. However, a few days earlier, the protocol had blocked a $50 million exchange attempt by the Bitget hacker.
The team first suspended cross-chain trading, then promised a full refund. But NEAR had precisely blocked these 50 million dollars. The feat therefore occurs even before the dust settles.
A bug in the Omni system shuts down eleven networks
Let's understand clearly. The attack exploits a bug between the Omni infrastructure and the NEAR Intents contract. Omni manages protocol deposits and withdrawals. As a result, NEAR Intents cut off deposits and withdrawals on eleven networks. The list includes BNB Smart Chain, Polygon, TON, Optimism, Avalanche, Stellar, Monad, X Layer, ADI, Scroll and Plasma.
The damage reached approximately 3.87 million USDT. These funds come from a single contract, deployed on BNB Chain. In other words, the exploitation did not affect the eleven channels.
NEAR confirms the bug
In a press release published on X on October 1, NEAR Intents confirms this bug. The team puts the loss at around $3.8 million, according to a preliminary report.
It has since fixed the flaw on the contract side, and services were expected to reopen in about an hour. On the other hand, deposits and withdrawals on the eleven networks remained cut off for around twelve hours. The Omni infrastructure had to be repaired.
“NEAR Intents services were interrupted earlier today following a security incident. This incident is due to a bug in the interaction between the Omni deposit and withdrawal infrastructure and the NEAR Intents smart contract. The preliminary report shows a total loss of approximately $3.8 million. These funds will be fully reimbursed.”
Users who hold assets from these chains in NEAR Intents will be able to trade them upon recovery. This is the case, for example, for funds housed in the HOT wallet or on near.com.
Furthermore, the team says it has contacted the police. She also works with specialists in security and on-chain analysis to trace funds. Finally, she promises a detailed report in the coming days.
This is the official version. But on the blockchain, traces tell another part of the story.
KuCoin, bitcoin: the trail of stolen funds
In this area, it was the investigator ZachXBT who raised the alarm on his Telegram channel. According to him, the NEAR Intents hot wallet on BSC recorded several abnormal exits. The wallet then stopped processing transactions.
“Community Alert: Near Intents has been exploited for over $3.8 million. Its hot wallet on BSC recorded several abnormal fund outflows a few hours ago.
The Near Intents hot wallet 0x233c has since stopped processing transactions. The site status page reports an incident in progress on several EVM chains.
The funds immediately went to KuCoin, then were bridged to Bitcoin.
Flight address on BSC:
0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37»
ZachXBT, on Telegram
Bitquery, however, refines this route. In an analysis published on X, the on-chain analysis company details the loot’s journey. The hacker first emptied the safe in five withdrawals, between September 30 and October 1. According to its statements from October 1, 76% of funds are now sleeping in bitcoin: 34.69 BTC spread across four wallets, still intact. About 21%, or $802,000, joined KuCoin via two routes. Finally, 2% rests on Hyperliquid, in the form of a Monero token. For its part, Unchained has not confirmed the KuCoin destination.
On the night of October 1 to 2, Alex Shevchenko, co-founder of Aurora and figure in the NEAR ecosystem, claimed on X to have “identified” the author of the attack. He asks him to return the funds to Bitcoin, BNB/Ethereum and Solana addresses. It gives him 48 hours before the responsible disclosure window closes.
The Bitget hacker had already tried his luck a few days earlier
A few days before this feat, NEAR Intents had refused a $50 million trade. The offer came from the Bitget hacker. According to Bitget, this hack exceeds $350 million. However, at this stage nothing links the two events.
