Weekly Deep Dive: The NEAR Intents Exploit That Ended With Every Dollar Back

1 1. In brief

On 1 October 2026, an attacker exploited a bug where NEAR Intents' Omni deposit-and-withdrawal system met its settlement smart contract, pulling about $3.865m of USDT out of a BNB Chain treasury contract across five main withdrawals. Within an hour the flaw was patched; within twelve, deposits and withdrawals on 11 supported networks had been paused and restored. The next day, general manager Alex Shevchenko publicly identified the attacker, gave them 48 hours, and published return addresses on Bitcoin, EVM chains and Solana.

What followed is the outcome this column had never recorded: everything came back. An on-chain negotiation — a 1 BNB message asking for a Signal contact, then roughly 34.59 BTC (about $2.95m) returned between 14:31 and 15:05 UTC on 2 October, then a final message acknowledging being 'in the wrong' and recommending bug bounties — ended with Shevchenko confirming the full amount was returned and closing the investigation that afternoon, 2 October. The exploit to recovery arc took roughly 36 hours.

2 2. Background: what NEAR Intents is, and what the Omni layer holds

NEAR Intents is a cross-chain trading and settlement protocol: users state what they want — swap X on one chain for Y on another — and the protocol's solvers and contracts route the transfer across its supported networks without the user manually hopping between bridges. That design concentrates two things in one place: the treasury infrastructure that settles across chains, and the deposit-and-withdrawal plumbing that connects those chains to the protocol's contracts. The Omni system is the second of those — the layer that moves value in and out.

A protocol with that shape holds a specific kind of risk. Every supported chain is a door, and every door's lock has to agree with the protocol's central contract about what constitutes a legitimate deposit or withdrawal. When those two systems disagree about a message, the difference is extractable. The incident came days after NEAR Intents had frozen more than $500,000 of transfers linked to the Bitget breach — the protocol was, ironically, part of the prior week's response machinery.

3 3. Mechanism: a bug at the junction of two systems

The vulnerability was not in the core NEAR blockchain and did not involve its token. It lived in the interaction between the Omni deposit-and-withdrawal infrastructure and the NEAR Intents smart contract — the seam where one system's output becomes the other's input. The attacker used it to make the BNB Chain treasury contract release USDT it should not have released: about $3.865m across five main withdrawals straddling 30 September and 1 October.

The preparation was visible in hindsight. Bitquery's on-chain record shows $10 and $11 test transfers the night before the main drain — the attacker confirming the path worked end to end before committing to it. The stolen funds then moved to KuCoin and through a bridge into Bitcoin, the standard first hop of a laundering route.

4 4. Detection, response and the patch

The protocol's SHIELD monitoring flagged the activity during the drain. From detection, the sequence ran in hours: the vulnerability was patched within about an hour; intent-matching resumed the same day; and deposits and withdrawals across 11 supported networks — BNB Smart Chain, Polygon, TON, Optimism, Avalanche, Stellar and others — stayed paused for roughly 12 hours while the infrastructure was repaired. Only USDT on BNB Smart Chain was affected. The protocol also committed, during the incident, to compensating any affected users in full.

That last commitment matters more than it first appears. It converted the incident from a user-loss event into a treasury-loss event before the recovery was known — which meant the team could run the response on its own timeline rather than under user-run pressure, and it meant the eventual return of funds meant no user ever absorbed a loss.

5 5. The ultimatum and the negotiation

On 2 October, Shevchenko posted that the team had identified the person responsible — 'We have identified you, sir' — gave them 48 hours to return the funds, and published return addresses on Bitcoin, EVM chains and Solana. Blockchain investigator ZachXBT had separately traced the stolen funds through KuCoin and a bridge into Bitcoin, making the laundering route public while the ultimatum clock ran.

The attacker's response came in three visible steps, each on-chain. First, a 1 BNB transaction to the recovery address carrying a message: 'Willing to cooperate, reply with your Signal so contact is possible.' Second, the Bitcoin return: roughly 34.59 BTC — about $2.95m — arrived at the published address between 14:31 and 15:05 UTC on 2 October, well inside the deadline. Third, a final BNB Chain message at 16:15:28 UTC saying the funds had been returned in full, acknowledging being 'in the wrong', thanking the NEAR team for its handling of the negotiations, and recommending bug bounties over live exploitation. Shevchenko confirmed the full amount was returned and closed the investigation that afternoon, 2 October. The visible Bitcoin and BNB Chain activity is part of the trail, not a complete asset-by-asset reconciliation — but the protocol's confirmation covers the full amount.

6 6. Data: the numbers, and what each one measures

The scale comparison with last week's subject is the sharpest single number in this report: Bitget lost roughly $387.5m — about one hundred times the NEAR Intents amount — and its recovery percentage is still unknown a fortnight later. NEAR Intents lost 1% of that and closed the file the next day. Scale bought the Bitget attacker time; visibility cost the NEAR Intents attacker theirs.

7 7. What actually forced the return

Attribution is tempting, but the mechanics were more ordinary. The attacker returned the funds because three things were true at once: the exit route was visible (ZachXBT had published the KuCoin-and-bridge-to-Bitcoin trail), the counterparty had claimed identification publicly and committed to it, and the money had not yet disappeared into mixing depth. An ultimatum is only as good as the tracing behind it — 'we know who you are' is a credible threat only when the trail supports it.

The other precondition deserves equal weight: the attacker still held most of the proceeds in a form they could move. The 34.59 BTC slice returned in the first window was roughly $2.95m of the $3.865m — the part that had completed the conversion from USDT. Returning it was cheaper than being identified as the holder of stolen, traceable bitcoin on a compliant exchange. Cooperation began after the theft, the tracing and the ultimatum — never before — which is why this is not a white-hat disclosure, whatever the final message recommended.

8 8. The same window, three layers, three outcomes

The common structure is the compromised step's proximity to custody. MetaMask's attacker got one step short of the money — a payout address, not a withdrawal key — so the cost was 45 days of foregone rewards. NEAR Intents' attacker got one step into the money and was pulled back by the response. Bitget's attacker got fully in, through a trusted internal system, and the recovery remains open. The distance between a payout instruction and the actual custody of funds is the variable that priced all three outcomes.

9 9. Impact assessment: who is actually exposed

The unresolved row is the last one. If the flaw was a local implementation mistake, the incident closes with the patch. If it was a property of how Omni-style deposit-withdrawal systems hand off to settlement contracts, every protocol with the same shape inherits the finding, and the post-mortem becomes required reading for more than this protocol's users.

10 10. What this changes for due diligence

• For cross-chain users: intent bridges concentrate treasury risk at layer junctions — the seam between the movement plumbing and the settlement contract is the place a bug is most extractable. Treatment of a bridge's pause-and-patch speed as a quality signal is now backed by a data point: one hour to patch, twelve to restore, nobody hurt.
• For protocols: rehearse the full arc, not just the technical half. The response that worked here had five rehearsed-looking components — monitoring that flagged mid-drain, a fast patch, a wide pause, a compensation commitment, and a public identification with published return addresses. Any one missing and the outcome is probably different.
• For investigators and exchanges: the tracing was the leverage. KuCoin sitting on the trail is what made the ultimatum credible; the industry's 100%-recovery rate moves with how fast the first laundering hop gets published.
• For attackers — in the only sense that matters here: the on-chain record is permanent, including the apology. Five withdrawals, two test transfers, one negotiation and one recantation are all in the history forever.

11 11. What would change our read

This assessment rests on the protocol's statements and public on-chain reporting. It would change materially if the promised post-mortem shows the loss was larger than the $3.865m accounted for, if the return transactions do not reconcile to the full amount once published in detail, if the identification claim is contradicted rather than confirmed by the technical report, or if the bug proves architectural in a way that implicates peer protocols. The post-mortem and the return-transaction reconciliation are the two documents to read when they arrive.

The broader conclusion does not depend on those details. Three incidents in eight days — Bitget, NEAR Intents, MetaMask Staking — priced the same variable at three layers: how many steps of unverified trust sit between an instruction and custody. The industry's best week of incident response in this sample still required a nine-figure failure the week before to look good against. Fast patches and full refunds are the response working; fewer junctions holding treasury funds is the design that would make the response unnecessary.

12 12. In brief

NEAR Intents lost about $3.865m on 1 October 2026 to a bug at the junction of its Omni deposit-withdrawal system and its settlement contract on BNB Chain. The patch landed within an hour, 11 networks paused for about 12 hours, and after a public identification and a 48-hour ultimatum — backed by published tracing through KuCoin into Bitcoin — the attacker returned every dollar within roughly 36 hours, leaving an on-chain message recommending bug bounties. The investigation closed on 2 October.

It is the first complete arc in this series: a breach where the response machinery outran the laundering and nothing was lost. The caveats are real — cooperation followed pressure, not process, and the post-mortem is still owed. But the template is now on the record, and it was built by a monitoring system, a patch team, an investigator's thread and a deadline.