TLDR
A major DeFi cross chain router that lost about $3.8 million to an exploit has now patched the bug and recovered the stolen funds.
- NEAR Intents, a cross chain swap router on NEAR, was drained of roughly $3.8 million from a BNB Chain USDT vault while the NEAR base chain stayed unaffected.
- The team patched a bug in its deposit and withdrawal integration, briefly paused 11 networks, and says cross chain infrastructure is back online with a commitment to fully compensate users.
- The attacker reportedly returned the funds after a public 48 hour ultimatum, underscoring that integration layer bugs remain a key risk when using DeFi routers and bridges.
Deep Dive
1. What Happened In The Exploit
Reports indicate that NEAR Intents, a cross chain router running on NEAR, lost about $3.865 million in a BNB Chain vault exploit on October 1 that affected USDT deposits and withdrawals on BSC only. A post mortem summary says the flaw was in how its Omni deposit and withdrawal infrastructure interacted with the smart contract that held user funds, with no evidence that NEAR Protocol or its consensus layer were compromised. One analysis reconstructs the attack as a series of test withdrawals followed by five large pulls totaling about $3.8 million, then complex routing across multiple chains and services including Chainflip, THORChain and KuCoin.
The incident was serious but localized to one vault and one asset, rather than a fundamental failure of the NEAR blockchain itself.
2. How The Bug Was Patched
NEAR Intents paused services after its SHIELD security layer flagged anomalous activity, then patched the contract side vulnerability within roughly an hour and took its app back online. An official update said deposits and withdrawals on 11 networks, including BNB Chain, Polygon, ethereum/">Optimism and Avalanche, remained disabled for around 12 more hours while the Omni infrastructure was fixed. Later status dashboards listed cross chain infrastructure and integrated blockchains as operational, even as some core services still showed partial outage, and the team promised a detailed public report on the incident.
From a user perspective, the router is functioning again, but the promised full technical write up will be important to judge how robust the fix really is.
3. Hacker Return And User Takeaways
After tracing flows and identifying the attacker, NEAR Intents general manager Alex Shevchenko publicly gave the hacker 48 hours to return funds to listed Bitcoin, Ethereum or Solana addresses. Follow up reporting says the published recovery wallets later received sufficient assets for the team to declare that funds from the roughly $3.8 million exploit had been returned in full and that the investigation was ending. Even so, analysts point out that this exploit, plus earlier incidents involving other NEAR ecosystem tools, highlight how bugs at the adapter or router layer can create losses even when a base protocol like Aave or NEAR remains technically secure.
When you use cross chain routers and intent based tools, the main risk is often in the glue code and integrations, so watching audits, incident history and how teams handle bugs is as important as checking the underlying chains.
Conclusion
The patched $3.8 million NEAR Intents exploit shows that modern DeFi risk increasingly sits at cross chain and integration layers rather than core chains alone. In this case, fast detection, a focused patch and a negotiated return of funds limited lasting damage, but users of routers and bridges should treat security practices, incident responses and infrastructure design as central parts of their risk assessment.
CoinsKid.Com