NEAR Intents suspends services after attack
NEAR Intents detected the incident on Thursday and halted its services while it investigated. The response is reminiscent of Liquid Network’s suspension after nearly 4,000 BTC were withdrawn, although the two incidents had different technical causes.
In this case, the problem stemmed from a bug in the interaction between the Omni infrastructure handling deposits and withdrawals and the NEAR Intents smart contract. The preliminary estimate is approximately $3.8 million.
Initial on-chain data provides further detail. A wallet associated with the service on BNB Chain reportedly sent several unusual transactions before the system was halted. Unchained says it identified approximately 3.87 million USDT received from an address described in NEAR Intents’ documentation as belonging to the HOT Bridge treasury on BNB Chain.
At this stage, this is therefore not a hack of the NEAR network itself.
NEAR Protocol continues to produce blocks. The incident concerns application infrastructure built around cross-chain transfers.
That distinction is essential.
KuCoin, then Bitcoin, to obscure the trail
Once the funds had been withdrawn, the attacker did not remain on the same blockchain for long.
According to ZachXBT, the assets were sent to KuCoin before being converted or bridged to Bitcoin. The attacker’s identity remains unknown.
The use of a centralized exchange is noteworthy because it could provide an additional investigative lead if identifiable accounts were involved. Moving the funds to Bitcoin then makes their path harder to follow, particularly if they are split up or sent to other services.
Movement across multiple networks is one of the major challenges in cross-chain security. Router Protocol also suffered several incidents before shutting down, despite years of work on blockchain interoperability.
NEAR Intents has already reported the case to the authorities and says it is working with companies specializing in security and blockchain analytics to trace the funds and attempt to recover them. A full technical report is expected to be published in the coming days.
The protocol has also announced that the $3.8 million lost will be fully compensated.
Users should therefore be reimbursed even if the funds themselves are never recovered.
The timing with Bitget is particularly ironic
The incident occurred just days after a security operation that had been much more favorable to NEAR Intents.
During Bitget’s recent hack, estimated at approximately $388 million, the Intents infrastructure helped block movements linked to the attacker. The protocol said it had prevented a swap worth approximately $50 million and frozen more than $500,000 in additional funds.
Just days later, its own transfer system was exploited.
The contrast illustrates the complexity of cross-chain infrastructure. A protocol can detect and block suspicious funds while remaining vulnerable to an error in the interaction between two components of its own system.
That distinction matters more than the phrase “NEAR was hacked.”
Critical vulnerabilities can sometimes directly affect a blockchain’s consensus. Here, there is no indication that NEAR’s consensus, validators or blockchain were compromised.
The core of the problem lies in the layer that allows NEAR Intents to move assets easily between multiple networks.
The service claims more than $30 billion in historical volume across 35 blockchains. The smoother this cross-chain abstraction becomes for users, the more the underlying infrastructure must manage contracts, wallets and deposit systems spread across numerous networks.
That is precisely where the bug struck.
NEAR Intents says it has fixed the smart contract-side vulnerability. Several networks were nevertheless expected to keep deposits and withdrawals suspended for longer while fixes to the Omni infrastructure were completed. They include BNB Chain, Polygon, TON, Optimism and Avalanche.
