0x0c5a5d910c5a…0c5a5d8e

ConfirmedSecurity526 vB61 sat/vB3 min decode

Near Intents Halts Service After $3.8M Omni Layer Breach

Near Intents suspended all operations Thursday after an attacker drained about $3.8 million through a bug in its Omni deposit layer. The team pledged full user compensation as on-chain investigator ZachXBT traced proceeds to KuCoin and bridged Bitcoin flows.

Near Intents Hacked for $3.8M Days After Denying North Korea-Linked Bitget Hacker
WitnessNear Intents Hacked for $3.8M Days After Denying North Korea-Linked Bitget HackerAI-generated

Outputs

  1. Near Intents halted all operations Thursday after an attacker drained approximately $3.8 million through a bug in its Omni deposit and withdrawal layer.

  2. On-chain investigator ZachXBT traced the proceeds through KuCoin and bridged sums onto Bitcoin.

  3. NEAR slid 8.93% to $4.86 on the day; shares of the newly listed Bitwise NEAR ETF lost more than 7%.

  4. The exploit followed Near Intents' block of a $50 million swap attempt linked to the prior week's $387.5 million Bitget hack.

  5. Bitwise filed the original NEAR ETF paperwork in April 2025 when the token traded at $2.61; the token has nearly doubled since.

Near Intents, the cross-chain swap service built on the NEAR blockchain, halted all operations on Thursday after an attacker drained about $3.8 million through a flaw in its Omni deposit and withdrawal layer.

The team disclosed the incident on X, posting: "Earlier today NEAR Intents services were stopped after a security incident was detected. The incident was caused by a bug in the Omni deposit and withdrawal infrastructure interaction with NEAR Intents smart contract."

The company said it has reported the matter to law enforcement and is working with security and analytics partners to trace the funds.

On-chain investigator ZachXBT separately traced the proceeds through KuCoin and bridged sums onto Bitcoin, posting the workflow to his public feed.

What preceded the exploit?

The breach landed two days after Near Intents publicly blocked a $50 million swap attempt tied to the prior week's Bitget hack. Bitget lost about $387.5 million in that incident, according to public statements from the exchange.

Gracy Chen, the exchange's CEO, and blockchain-analytics firm Elliptic both pointed to a North Korea-linked actor, citing operational patterns consistent with Pyongyang's known theft groups. Neither party has confirmed attribution conclusively.

Near Intents has not said whether the Thursday drain and the blocked Bitget transaction share an originator.

Is user money protected?

Near Intents pledged that the lost funds "will be compensated in full," a guarantee that sets the protocol apart from the absent deposit-insurance standards of most crypto venues. The team has yet to specify the reimbursement mechanism, the dollar cap or the distribution timeline.

How severe is the operational damage?

The protocol says the contract-side vulnerability is patched and core swap functions should resume within about an hour. Deposits and withdrawals on 11 connected networks — including BNB Chain, Polygon and Optimism — will stay offline for approximately 12 more hours while the Omni fixes complete.

What is the broader market impact?

The disclosure compounded a weak week for the NEAR token. NEAR slid 8.93% to $4.86 on the day. Shares of the newly listed Bitwise NEAR ETF lost more than 7%, pulling back from Monday's launch.

The fund lets ordinary brokerage customers hold token exposure without a self-custody wallet. Bitwise filed the original paperwork in April 2025 when NEAR traded at $2.61. The token has nearly doubled since.

Why are bridges a structural risk?

Cross-chain swap protocols aggregate liquidity in a middle layer to execute trades across networks that cannot otherwise communicate. That pooled capital sits in smart contracts and has historically attracted attackers.

The 2022 Harmony bridge hack erased about $100 million in user deposits. Near Intents has routed more than $30 billion in swaps across 35 blockchains to date — a volume record that contextualizes the Thursday loss as a small fraction of total platform activity, though hardly a precedent.

Near Intents said it will publish a detailed incident report in the coming days. The 12-hour withdrawal suspension on the remaining 11 networks and the post-mortem's findings will be the next near-term catalysts for users weighing whether to route flow back through the protocol.

via x.com (Original)

More from Tom Whitfield

Tom Whitfield

Show full bio

News editor covering media and advertising at Mempool Brief.

419 articles