DeFi router patches $3.8M exploit fast

TLDR

NEAR Intents, a DeFi cross-chain router, suffered a roughly $3.8 million exploit but patched the bug quickly, restored services, and reports the stolen funds have been returned.

1. The exploit drained a USDT vault on BNB Chain via a router infrastructure bug, but monitoring triggered a pause and patch within about an hour.
2. Cross-chain deposits and withdrawals were briefly suspended across 11 networks, with the team pledging full user reimbursement and later announcing complete fund recovery.
3. The incident underscores structural risks in DeFi routers, making post-mortem details and design changes important signals for anyone relying on cross-chain services.

Deep Dive

1. Exploit And Rapid Patch

NEAR Intents reported a preliminary loss of about $3.8 million from a vulnerability in how its Omni deposit and withdrawal infrastructure interacted with a NEAR Intents smart contract, affecting a USDT pool on BNB Chain. The team says its SHIELD monitoring system flagged abnormal behavior, services were paused, and the contract-side vulnerability was patched within an hour.

During the fix, deposits and withdrawals on 11 networks, including BNB Chain, Polygon and ethereum/">Optimism, stayed offline for roughly 12 hours while Omni infrastructure was updated before cross-chain operations resumed. Reports emphasize that NEARs base blockchain and consensus were not compromised, framing this as an integration-layer issue rather than a core protocol failure.

2. User And Ecosystem Impact

NEAR Intents pledged to reimburse affected users in full and said the exploit was limited to the USDT vault on BNB Chain, not user wallets on NEAR itself, according to a technical summary of the Omni interaction bug. General manager Alex Shevchenko publicly claimed the attacker had been identified and published return addresses, giving them 48 hours to send funds back under responsible disclosure.

Subsequent reporting says funds from the exploit had been returned in full, with Bitcoin and EVM wallets receiving value that roughly matches earlier loss estimates, though a detailed asset-by-asset reconciliation is still pending. NEAR-related markets saw short term volatility but the broader narrative now centers on how the ecosystem handles infrastructure security rather than a lasting protocol failure.

Confidence: high because multiple independent reports align on loss size, cause, patch timing and recovery, while exact accounting per asset remains to be clarified.

3. Router Risk And Next Steps

Cross-chain routers like NEAR Intents concentrate risk at the boundaries between chains, where bugs in deposit or withdrawal logic can move large pooled funds with a single exploit. The team has said it will add formal verification to contract releases and expand SHIELD partnerships to strengthen monitoring and information sharing, using this incident as a catalyst for harder infrastructure review.

For users, the key signals to watch are: a promised public technical post-mortem, any changes to router architecture or Omni integrations, and future downtime notices for cross-chain services they depend on. How transparently NEAR Intents documents the exploit and recovery will shape confidence both in the router and in similar DeFi infrastructure.

Conclusion

This exploit shows that even well-used DeFi routers can leak millions when integration-layer bugs slip through, but also that rapid monitoring, pausing and patching can contain damage and support recovery. If NEAR Intents follows through with clear post-mortems and stronger verification, the episode may ultimately push router design and security practices across DeFi in a safer direction.