By Daniel Okafor

NEAR Intents, the cross-chain swap layer operated on NEAR Protocol, lost approximately $3.8 million in an exploit that the project has traced to a bug in a smart contract deposit function, The Crypto Times reported. The disclosure landed without a published post-mortem, and the on-chain address of the attacker, the precise starting block, and the duration of the exploit window remain unconfirmed at the time of writing.

What does the disclosure actually say?

The Crypto Times report confirms only the headline figure and the deposit-function origin. It does not name the affected contract, identify the function signature, or specify whether the vulnerability was a logic error, a reentrancy flaw, or an access-control failure. The NEAR Intents team has not yet published its own post-mortem, leaving the technical community to work from a single secondary source.

How NEAR Intents settles a cross-chain swap

The protocol runs an intent-based trading architecture. Users declare a desired swap outcome, and a network of competing solvers bids to fulfill the order. Settlement is processed on NEAR, with the chain acting as a coordination layer for assets that originate on other networks. This design has positioned the protocol as one of the more active venues in the broader intent-based trading category, where competitors including UniswapX and Across have also drawn institutional attention.

The deposit function sits at the heart of that workflow. It is the entry point through which solvers fund the escrow that backs each user request, and through which cross-chain messages are authenticated before they reach the solver pool. A bug in this layer typically points to a flaw in how the contract accepts, holds, or releases escrowed assets.

What does the $3.8 million figure tell the market?

The figure places the incident in the middle of the band that has come to define serious-but-bounded DeFi exploits over the past two years. It is large enough to require a public explanation from the operating team, but small enough that a recovery fund or treasury reimbursement is technically feasible if the project's governance process supports it.

The NEAR Intents team has not yet disclosed whether affected users will be made whole, whether the bug was reported through a structured bug-bounty program, or whether the deposit contract had been audited by a named firm prior to deployment. Until those details emerge, market participants will price the protocol on the assumption that similar deposits remain paused.

What is the broader read for NEAR?

The incident lands at a sensitive moment for the broader NEAR ecosystem. NEAR Protocol has spent recent quarters positioning itself as a settlement venue for institutional tokenization and AI-agent payment flows, and a deposit-function bug cuts against that pitch. Institutional counterparties have increasingly demanded third-party audits and formal verification of bridge and settlement code, and the absence of a published audit trail on the affected deposit contract would weigh on that narrative.

Watch for a full post-mortem from the NEAR Intents team, including the affected contract address, the audit history of the deposit contract, and a clear remediation timeline. The market's read on the protocol over the coming days will hinge less on the dollar figure and more on the disclosure mechanics.