DeFi routing platform pauses after $3.8M exploit

TLDR

NEAR Intents, a cross-chain DeFi routing platform, halted services after a bug let an attacker drain about $3.8 million, underscoring risks in bridge and routing infrastructure.

1. The exploit hit a USDT vault on BNB Chain via a bug in NEAR Intents Omni routing layer, prompting a full service pause and rapid patch.
2. User losses are estimated near $3.8 million, with the team pledging full reimbursement and reporting that funds routed to recovery wallets have largely been returned.
3. The incident spotlights growing systemic risk in cross-chain intent routers and makes upcoming audits, postmortems and security upgrades key things to watch.

Deep Dive

1. Exploit Mechanics And Service Pause

Reports say NEAR Intents discovered a flaw in how its Omni deposit and withdrawal infrastructure interacted with a NEAR Intents smart contract, allowing an attacker to drain around $3.8 million from a USDT pool on BNB Chain. A detailed summary from TokenPost describes the bug as sitting in the cross-chain layer that connects deposits and withdrawals across networks, rather than in the core NEAR blockchain itself, with NEAR Protocol and the NEAR token unaffected by the incident.

Once abnormal activity was flagged, NEAR Intents halted services, patched the contract vulnerability in roughly an hour, and kept deposits and withdrawals across 11 networks offline for about 12 more hours while Omni infrastructure fixes were completed.

2. User Impact And Ecosystem Risk

NEAR Intents has processed several billion dollars per month in routing across dozens of networks, so a $3.8 million hit is operationally contained but material for affected users and trust. The team publicly committed to reimburse users in full, and follow-up coverage notes that recovery wallets have received significant amounts of Bitcoin and other assets, suggesting much of the stolen value has been returned, though asset by asset reconciliation remains incomplete in public reports.

This exploit follows another NEAR-linked DeFi incident at Rhea Finance earlier this year, raising questions about security practices around NEAR ecosystem applications rather than NEAR Protocol itself, as highlighted in a broader CryptoSlate analysis.

3. What To Watch Next

NEAR Intents has promised a full public postmortem and has signaled plans to expand formal verification and other security checks around its contracts and infrastructure. A Cointelegraph report notes that general manager Alex Shevchenko issued a 48-hour ultimatum to the attacker to return funds, using published recovery addresses on multiple chains, indicating a willingness to use public pressure as part of the response strategy.

Going forward, key signals will be: whether all user reimbursement is completed, how independent audits assess the routers design, and whether similar cross-chain routing platforms review or change their own deposit and withdrawal flows in response. For NEAR, continued institutional inflows into products like the Bitwise NEAR ETF despite this app-level exploit would suggest investors distinguish between application risk and base-layer risk.

Conclusion

The pause at NEAR Intents came from a specific bug in its cross-chain routing layer that enabled a targeted vault drain, not a failure of the NEAR base chain. The quick patch, commitment to full reimbursement and apparent partial or full fund recovery reduce immediate contagion, but the incident underlines how complex cross-chain routers can become single points of failure. Watching the eventual postmortem and how other routers react will be important for anyone relying on DeFi intent or routing platforms across multiple networks.