Most exploits end with a post-mortem and a loss. This one ended with a refund. Two days after a bug in NEAR Intents’ deposit and withdrawal plumbing let someone walk off with about $3.8 million, NEAR said every dollar had come back — after the team identified the person and gave them 48 hours to return the funds.
It’s a good outcome, but not a reason to relax. The service was halted, deposits and withdrawals on 11 networks stayed down for hours, and the NEAR token took a hit. The story is a useful look at what happens to cross-chain infrastructure when one component breaks.
Key facts
- On October 1, 2026, an attacker exploited a bug in the interaction between NEAR’s Omni deposit and withdrawal infrastructure and the NEAR Intents smart contract, taking about $3.8 million.
- NEAR Intents and Near.com were halted; deposits and withdrawals on 11 networks, including BSC, Polygon and Optimism, stayed offline for roughly 12 more hours.
- On-chain investigator ZachXBT spotted irregular outflows from a BSC hot wallet; the funds moved through KuCoin and were bridged to bitcoin.
- NEAR identified the person and gave them 48 hours to return the funds under “responsible disclosure.”
- By October 3, NEAR general manager Alex Shevchenko said the $3.8 million had been “sent back in full.”
- On October 1, NEAR fell 6.7% to $4.96 and Bitwise’s two-day-old NEAR ETF (NRR) dropped 6.4%, according to The Block.
What happened to NEAR Intents on October 1?
On October 1, 2026, an attacker drained about $3.8 million from NEAR Intents by exploiting what the team described as a “bug in the Omni deposit and withdrawal infrastructure interaction with NEAR Intents smart contract.” NEAR halted NEAR Intents and Near.com, and promised to cover users in full and publish a post-mortem.
NEAR Intents is a cross-chain swap system: users state what they want, and solvers fill the order across chains. Omni is the layer that moves assets in and out. The bug sat at the seam between the two — exactly the kind of place where cross-chain systems tend to break.
According to The Block, deposits and withdrawals on 11 networks, including BSC, Polygon and Optimism, stayed offline for about 12 more hours after the halt. ZachXBT flagged irregular outflows from the BSC hot wallet. The stolen funds were routed through KuCoin and bridged to bitcoin.
Market reaction
The hit was quick. The Block reported that NEAR fell 6.7% to $4.96 on October 1, and Bitwise’s NEAR ETF (NRR), which had been trading for only two days, lost 6.4%. Prices are cited for context only, not as a forecast.
How did NEAR get the $3.8 million back?
NEAR got the $3.8 million back by identifying the person behind the exploit and giving them 48 hours to return the funds under a “responsible disclosure” framing, according to Cointelegraph. By October 3, general manager Alex Shevchenko announced the money had been returned in full.
“The funds from the $3.8M NEAR Intents hack were sent back in full,” Shevchenko said, as reported by Cointelegraph. He also asked security researchers to “use bug bounties instead of disrupting the services.”
How exactly the money came back is less clear. According to The Crypto Basic, about 34.59 BTC (roughly $2.95 million) went to NEAR’s published recovery address, and the remaining ~$850,000 was returned another way. Other outlets did not break the figures down.
A returned hack is still a hack. The halt happened either way.
Is NEAR Intents safe to use after the exploit?
NEAR says users will be fully covered, and the stolen $3.8 million has been returned, so the direct loss is resolved. Whether NEAR Intents is safe going forward depends on the fix and the promised post-mortem, which explains the root cause. Until it’s published, treat any cross-chain route as carrying infrastructure risk.
A few practical rules apply to every intent-based or bridge-based system, not only NEAR:
- Don’t leave balances parked inside a cross-chain protocol longer than you need to.
- When a service halts, wait for official status updates instead of retrying deposits.
- Read the post-mortem when it lands; vague ones are a signal in themselves.
Our guide on bridge hacks and how to swap safely covers the wider pattern. This is a different story from the recent NEAR Confidential Intents rally — that one was about growth, this one is about plumbing.
What does this mean for swap users?
For swap users, the lesson is about redundancy. When one route goes down, you want to see the others immediately rather than discover the outage mid-swap.
SwapZilla’s DEX shelf lists NEAR Intents among its DEX quote sources, side by side with CEX providers. During an outage like this one, that route simply isn’t quoted, and the quotes from the other providers remain on the list. SwapZilla does not hold funds: each swap runs through the provider you pick, and coins go straight to your address. If you want a refresher on how the different route types compare, see DEX vs CEX vs swap aggregator.
Final thoughts
NEAR got lucky and acted fast: the attacker was identified, the ultimatum worked, and the $3.8 million came back within days. Plenty of projects never get that chance. Shevchenko’s appeal to use bug bounties rather than live exploits is fair — but the bigger question is why a seam between two systems could be drained in the first place.
The post-mortem should answer that. Until then, the takeaway is the same as after every cross-chain incident: keep exposure short, keep alternatives in view, and don’t confuse a happy ending with a safe design.