Near Intents exploit analysis

On 1 October 2026, NEAR Intents, a multichain transaction protocol built on NEAR, halted operations after an attacker drained about $3.8 million from its Omni deposit-and-withdrawal infrastructure (the record). NEAR Protocol's main blockchain and native token were unaffected, but the incident affected 11 networks that relied on the Omni layer for cross-chain swaps: BNB Chain, Polygon, TON, Optimism, Avalanche, Stellar, Monad, LayerX, Adi, Scroll, and Plasma (Protos).

The vulnerability sat in the contract-side code that handled deposits and withdrawals, not in the off-chain relayer that moves messages between chains. NEAR Intents disclosed the incident at 2pm GMT+1 on 1 October and said the issue had been detected, contained, and patched within hours (Protos). Deposits and withdrawals across the 11 networks remained suspended while the Omni infrastructure was being repaired, though trading resumed on most networks by the end of the day.

Funds moved quickly. Blockchain sleuth ZachXBT tracked irregular outflows from the NEAR Intents BNB Chain hot wallet, followed by transfers through the KuCoin exchange and a bridge to Bitcoin (Protos, Blockonomi). The NEAR token fell from $5.10 to $4.79 in the minutes after the disclosure (Protos).

The protocol named the attacker publicly. General Manager Alex Shevchenko posted wallet addresses for returning the funds and a short ultimatum: "We have identified you, sir" (the record). NEAR Intents committed to compensating any affected users in full regardless of the recovery outcome, framing the loss as a hit to the protocol's own finances rather than to depositors (Blockonomi).

About 24 hours after the protocol's threat, the attacker sent the funds back in a single transaction, with an on-chain message that read "We've returned all the funds, we were in the wrong" (the record). Shevchenko confirmed the return and said the investigation was ending. "We are stopping the investigation. Please use bug bounties instead of disrupting the services", he wrote on X (Blockonomi).

The mechanism itself is the part the public reporting leaves thinnest. The articles describe a defect in how the Omni layer's deposit-and-withdrawal system communicated with its smart contracts, but do not name the specific function, the parameter the attacker manipulated, or whether the issue was a missing check, a logic error, or an access control gap. NEAR Intents has not, as of the sources available here, published a post-mortem with that detail.

The recovery puts the case alongside a small set of high-value incidents where the attacker returned the funds after being identified. The closest comparison in the corpus is the 2021 Liquid Network theft, in which about 4,000 BTC (~$320 million at the time) was taken by a person or group that identified themselves as whitehats and returned roughly 90% of it after a public negotiation (Liquid Network exploit analysis). The NEAR Intents case differs in two ways: the protocol rather than the attacker drove the identification, and the timeline was 48 hours rather than months. The 11 affected chains also had no comparable counterpart in Liquid, where the loss stayed within a single exchange's hot-wallet system. Other incidents in the feed with stolen funds returned in full are not present in the corpus, and a few stolen-fund records from 2024 and 2025 sit without any public follow-up on recovery.

The Bitget context matters for the broader week. Days before this incident, Bitget had been exploited for over $380 million in an attack attributed to North Korea (Protos). Shevchenko said about $50 million of those funds had been routed through NEAR Intents, and the protocol froze $503,000 while roughly $166,000 passed through to other providers (Protos). The two incidents have not been linked as a single operation, and the corpus has no separate Bitget entry at present.