Cross-chain platform halts after $3.8M exploit

TLDR

Cross-chain protocol NEAR Intents suffered a roughly $3.8 million exploit, halting services and pausing deposits and withdrawals on multiple networks while it patches and investigates the breach.

1. A bug between NEAR Intents Omni infrastructure and its smart contract let an attacker drain about $3.8 million, prompting an immediate service halt and multi-chain withdrawal freeze.
2. The team pledges full reimbursement and says core services will resume quickly, but some networks remain disrupted and NEAR-related markets sold off on the news.
3. Next signals to watch are the post-mortem, reimbursement execution and broader security responses across cross-chain platforms that hold funds in hot wallets.

Deep Dive

1. Exploit Details

Several reports say NEAR Intents was hit on 1 Oct by a security bug in how its Omni deposit and withdrawal infrastructure interacted with the core smart contract, leading to losses of about $3.8 million in user funds. This forced the cross-chain trading platform to halt services and suspend deposits and withdrawals on 11 networks including BNB Chain, Polygon, TON, ethereum/">Optimism, Avalanche and others, while the vulnerability was patched and infrastructure repaired.

According to investigator ZachXBT and multiple outlets, the exploit started from a compromised BNB Chain hot wallet, with stolen assets routed to KuCoin and then bridged into Bitcoin, making recovery more complex. NEAR Intents says the contract-side flaw has been fixed and that it has reported the incident to law enforcement and engaged security and blockchain analytics firms to trace the funds, as covered in the detailed news from Coindesk and The Block.

Confidence: high because multiple independent reports and the projects own statements agree on the exploit size, cause and initial response.

2. User And Market Impact

NEAR Intents has publicly pledged to compensate affected users in full, though it has not yet published a granular reimbursement schedule; some coverage notes that the timeline and exact funding source remain unclear. Core services at near.com were expected to return within about an hour, but deposit and withdrawal routes on the affected networks were set to stay down for roughly 12 hours during Omni repairs, meaning short-term liquidity frictions for users with funds bridged through the platform.

The incident landed at a sensitive time for NEAR Protocol (NEAR). NEARs token dropped around 7 to 10 percent intraday and Bitwises new NEAR ETF similarly gave back recent gains, as highlighted in CryptoSlates analysis of the exploit and ETF flows. Importantly, current reporting says the underlying NEAR blockchain was not compromised; the issue sits in cross-chain application infrastructure rather than the base layer.

3. What To Watch Next

Key forward signals include NEAR Intents promised detailed post-mortem, which should clarify the precise bug, affected assets and security changes, plus hard dates and mechanisms for reimbursements. A credible recovery plan will need transparent treasury usage, clear eligibility rules and independent verification that compensation actually reaches impacted addresses.

More broadly, this exploit reinforces the structural risk in cross-chain platforms that rely on hot wallets and complex bridging logic to move funds across dozens of networks. For crypto users, it is worth tracking whether NEAR Intents and similar projects adopt stronger practices such as formal verification, reduced hot-wallet exposure, stricter withdrawal limits and real-time anomaly detection, all of which are discussed as future goals in post-incident commentary from CryptoSlate.

Conclusion

NEAR Intents $3.8 million exploit illustrates how bugs in cross-chain infrastructure can force immediate service halts and create real losses even when the base blockchain remains intact. The teams commitment to full compensation and rapid patching is positive, but the durability of trust will depend on how transparently it reports the incident, how quickly users are made whole and whether meaningful architectural security improvements follow.