Cross-chain router exploit hits $3.8M funds

TLDR

A cross-chain protocol called NEAR Intents suffered a bug-driven exploit that drained about $3.8 million and temporarily halted its router-style services across multiple networks.

1. NEAR Intents says a flaw in its Omni deposit and withdrawal infrastructure let an attacker pull roughly $3.8 million, mainly from a USDT pool on BNB Chain.
2. The team paused services, blocked deposits and withdrawals on 11 networks, patched the contract bug, and pledged full reimbursement while investigators trace funds routed through KuCoin into Bitcoin.
3. The incident highlights structural risks in cross-chain routers and comes just as NEAR-based products, including a new ETF, were attracting institutional flows, making follow-up security changes important to watch.

Deep Dive

1. What Actually Went Wrong

Reports say NEAR Intents, a cross-chain swap and intents system built around NEAR Protocol, was hit on 1 Oct when a bug in how its Omni infrastructure interacted with a NEAR Intents smart contract allowed unauthorized withdrawals of user funds, estimated at about $3.8 million in total, largely from a USDT pool on BNB Chain. TokenPost describes the issue as a flaw in the interaction between the Omni deposit and withdrawal system and the contract that holds router liquidity, exposing the bridge-style hot wallet to misuse instead of just a single chain pool.

On-chain investigator ZachXBT traced abnormal outflows from the protocols BNB Chain hot wallet, noting that stolen funds were sent to KuCoin and subsequently bridged into Bitcoin, as summarized by CoinDesk and Cointelegraph, which both emphasize that the bug affected the cross-chain infrastructure rather than the base NEAR blockchain itself.

2. Immediate Response And User Impact

NEAR Intents halted its service, including near.com, and temporarily disabled deposits and withdrawals across 11 networks such as BNB Smart Chain, Polygon, ethereum/">Optimism, Avalanche, TON, Scroll and others while the vulnerability was patched and Omni-layer fixes were applied, according to TokenPost and a detailed recap from Decrypt. The team has publicly committed to reimburse affected users in full, with several outlets including Coindesk and Yahoo Finance quoting that compensation pledge.

The project reported the incident to law enforcement and engaged security and blockchain analytics firms to trace and potentially recover funds. Crypto.news cites NEAR co-founder Illia Polosukhin saying the bug was identified and fixed within about an hour of detection, with core services coming back online quickly and remaining restrictions focused on the specific cross-chain routes under repair.

Separately, Aurora co-founder Alex Shevchenko told Yahoo Finance that his team believes it has identified the hacker and issued a 48 hour ultimatum listing repayment addresses on Bitcoin, BNB Chain, Ethereum and Solana, echoing a similar public-pressure tactic that previously helped recover funds after a different NEAR-linked exploit.

3. Broader Security And Market Implications

U.Today and CryptoSlate note that NEARs token sold off immediately after NEAR Intents confirmed the exploit, with intraday declines in the mid to high single digit percentage range, at the same time that a new Bitwise NEAR ETF had just attracted more than 50 million dollars in inflows. That combination puts a spotlight on whether investors will treat this as an application-layer router failure or as an ecosystem-wide red flag.

At a structural level, the incident underlines how cross-chain routers and intents systems concentrate liquidity in intermediary pools spanning many networks. When the infrastructure or its contract-level integration fails, losses propagate across chains, and funds can move rapidly through centralized venues like KuCoin and into base-layer assets such as Bitcoin before defenses react, as described in the Bitcoin.com and Decrypt coverage. Polosukhin has said NEAR plans to expand formal verification and other security measures for contracts at this scale, and a public postmortem has been promised.

Conclusion

The 3.8 million dollar NEAR Intents exploit was not a base-chain failure but a cross-chain router bug, yet it still disrupted multi-network liquidity and dented confidence around a growing NEAR ecosystem. Whether full reimbursement, transparent postmortems and stronger contract verification are enough to reassure users and ETF investors will depend on how quickly compensation arrives and how convincingly the next generation of cross-chain security is implemented.