Cross-chain router exploit triggers $3.8M losses

TLDR

Cross-chain trading protocol NEAR Intents was exploited for about $3.8 million, forcing it to pause services and cut off deposits and withdrawals across multiple networks.

1. An Omni infrastructure bug in NEAR Intents smart contracts let an attacker drain a BNB Chain USDT pool and route roughly $3.8 million via KuCoin into Bitcoin.
2. NEAR Intents patched the contract, halted cross-chain routing on 11 networks, and pledged full reimbursement, while NEAR fell around 6 to 9 percent and its new ETF dropped similarly.
3. The incident underscores growing risk in cross-chain routers, adding to major 2026 infra hacks, so users should watch the coming post-mortem, recovery efforts, and broader security responses.

Deep Dive

1. How The Exploit Happened

NEAR Intents is a cross-chain trading system that uses an Omni deposit and withdrawal layer plus smart contracts to route swaps across many chains. On October 1, a bug in that interaction allowed an attacker to drain a USDT pool on BNB Chain, producing estimated losses of about $3.8 million, according to multiple reports from outlets such as CoinDesk.

On-chain investigator ZachXBT and others reported irregular outflows from a NEAR Intents hot wallet on BNB Chain, with stolen funds sent to KuCoin and then bridged into Bitcoin, as noted by The Block. The team says the contract-side vulnerability has now been patched, and a detailed technical report will follow.

2. Impact On Users And NEAR

To contain the incident, NEAR Intents halted services and temporarily disabled deposits and withdrawals on 11 networks including BNB Smart Chain, Polygon, ethereum/">Optimism, Avalanche, TON, Stellar, Scroll and others, while core NEAR-based services were expected to come back online sooner, per TokenPosts summary. Users with assets parked in the affected cross-chain pools currently face access delays rather than total loss, because the treasury has pledged to reimburse every dollar of the stolen funds.

Market-wise, NEAR Protocol (NEAR) and the newly launched Bitwise NEAR ETF both dropped around 6 to 9 percent on the day of the exploit, reflecting short-term sentiment shock even though the bug hit cross-chain infrastructure rather than the base NEAR blockchain itself, as outlined by Decrypt. Auroras co-founder has since claimed to have identified the hacker and given a 48-hour public deadline to return funds, which could influence eventual recovery outcomes if successful, according to Finance Yahoo.

3. Broader Security Lessons And What To Watch

This exploit lands in a year already marked by large infrastructure hacks, including exchange and sidechain incidents that pushed September losses to record levels, as tracked in a recent CoinsKid community report. It highlights that cross-chain routers and intent-based systems concentrate funds and complex chain interactions, which creates attractive targets whenever integration bugs slip through.

Key next signals will be NEAR Intents full post-mortem, the speed and clarity of user reimbursement, any confirmed recovery of funds, and whether KuCoin or other venues take visible action on the traced assets. For users, the practical lesson is to treat cross-chain routers as infrastructure with its own risk profile and to avoid leaving large idle balances in such systems or in hot wallets tied to them.

Confidence: high, based on consistent reporting across major crypto outlets and NEAR Intents own public statements.

Conclusion

The $3.8 million NEAR Intents exploit was driven by a specific Omni smart-contract integration bug, not a fundamental failure of the NEAR base chain, but it still stresses the ecosystems cross-chain plumbing. The teams promise of full reimbursement and rapid patching are positives, yet the episode reinforces that routers which pool liquidity across many networks can become single points of failure. Watching how quickly users are made whole, how much of the stolen funds are recovered, and whether other projects harden similar infrastructure will be crucial for assessing ongoing risk in cross-chain trading.