On Thursday, October 1, NEAR Intents — the cross-chain swap layer routing volume across more than 35 blockchains — hit the pause button. A bug in the interaction between its Omni deposit-and-withdrawal infrastructure and its smart contract had let an attacker drain roughly $3.8 million in USDT from a BNB Chain vault. The team said the contract-side vulnerability was patched within about an hour of detection. Co-founder Illia Polosukhin pledged that every affected user “will be compensated in full.”
Then Friday got strange. General manager Alex Shevchenko posted a message addressed directly at the attacker: “We have identified you, sir.” Below it, three wallet addresses — Bitcoin, BNB/Ethereum, Solana — and a deadline: “You know better than most how responsible disclosure works — this is the last window to use it. After 48 hours, that window closes.”
Then Friday afternoon got even stranger: the money came back. All of it. Shevchenko announced that the exploiter had returned the funds in full, and the team closed the investigation.
A $3.8 million exploit, a public naming-and-shaming, a 48-hour clock — and a full recovery before the clock ran out. Here’s what actually happened, and the lesson most of the coverage is missing.
What happened, in order
- September 30 (prelude): Before touching serious money, the attacker tested the withdrawal path twice — once for $10, once for $11, according to an on-chain reconstruction by blockchain intelligence firm Bitquery. Both succeeded.
- October 1: NEAR Intents’ monitoring detected unusual activity and paused services. The team traced the problem to a bug in how the Omni deposit/withdrawal infrastructure interacted with the NEAR Intents smart contract. Preliminary losses: about $3.8 million in USDT on BNB Chain — roughly ₿43.8 at Bitcoin’s price near $86,700 on October 2, according to BitcoinVersus. Bitquery’s reconstruction puts the precise total at 3.865 million USDT, drained across five major withdrawals over roughly six hours — 800,000, 1.2 million, 1.5 million, 330,000, and 35,000 USDT, with the three largest landing inside roughly one hour.
- October 1 (later): The vulnerability was patched within about an hour of detection, per CoinDesk’s reporting. Services resumed, though some chains stayed restricted while the wider Omni infrastructure was secured. Full user compensation was pledged.
- October 2: Blockchain investigator ZachXBT traced the stolen funds through the KuCoin exchange and across a bridge into Bitcoin — about 76% of the stolen value, roughly ₿34.69, per CCN. Then came Shevchenko’s ultimatum: an allegedly identified attacker, a 48-hour responsible-disclosure window, and three return addresses.
- October 2 (afternoon): The full amount was returned at about 14:30 UTC, per Polosukhin. Shevchenko announced the complete recovery, said the investigation was closed, and asked future vulnerability-finders to “use bug bounties instead of disrupting the services.”
Note what remains undisclosed: no name for the attacker, and no published evidence beyond the team’s account. Polosukhin said the team identified the party within 24 hours using SHIELD, the platform’s AI security layer, plus “aggressive detective work” — but offered no technical specifics. The successful return lends credibility to the “we’ve identified you” claim in a way the original post did not. The promised full post-mortem is still pending as of this writing.
The real story: the attack surface moved up the stack
Here’s the part that matters for your own money. Nobody broke NEAR. Nobody broke BNB Chain. The base layers held. What broke was the glue — the deposit/withdrawal module sitting between chains, the part of the stack with the most moving pieces and the least battle-testing.
This is the pattern of crypto theft in 2026: attackers increasingly don’t bother with consensus mechanisms or validator sets. They go after the integration layer — bridges, intent solvers, vault contracts, the middleware that makes “cross-chain” feel seamless. It’s the same reason a house gets robbed through a window, not by demolishing a wall.
There’s a bitter irony here. Just days earlier, NEAR Intents had assisted in freezing funds from the $388 million Bitget breach of September 24, according to Cointelegraph. The plumber who helped fix someone else’s leak sprung one of their own. That isn’t hypocrisy — it’s the industry’s structural reality: the teams closest to the risk are the ones running the most complex code.
A 5-minute exposure audit you can run today
You can’t audit a smart contract over coffee. But you can audit your relationship to third-party infrastructure with five questions:
- Do you know which middleware touches your funds? If you swap across chains, something — a bridge, an intents solver, a vault — holds your assets mid-flight. Name it. If you can’t name it, you’re trusting it blindly.
- How long do your funds sit in hot infrastructure? The NEAR Intents attacker hit a live deposit/withdrawal flow. Assets parked in cross-chain queues are the juiciest targets. Move deliberately; don’t leave funds marinating in transit.
- What are your token approvals? Unlimited approvals to a compromised contract turn one bug into your personal loss. Reviewing and revoking stale approvals is the cheapest security habit in crypto.
- Does the protocol have a track record of making users whole? NEAR Intents pledged full compensation within hours — and recovered everything within a day. That response posture matters more than any audit badge when things go wrong.
- Is the base chain even the risk? When something breaks, ask which layer failed before you panic-sell the token. NEAR the token didn’t fail; an Omni module did. Conflating the two is how fear gets mispriced.
The part they got right
Credit where it’s due: the incident response here is close to a template. Detection flagged it, services paused fast, the patch landed in about an hour, communication was prompt and specific (asset, chain, amount, cause), and compensation was pledged before users had to ask. Compare that to the industry’s long history of “funds are safu” tweets followed by silence. The 48-hour ultimatum looked like theater — but it was theater backed by real identification, and it worked: every cent was back within 24 hours.
The takeaway
Every cycle, crypto’s losses concentrate wherever the newest, most complex code meets the most money. Right now that’s the cross-chain layer: intents, solvers, bridges, vaults. The blockchains underneath are among the most audited software in the world. The plumbing between them is not.
So the practical rule: make the math before you make the move. Know which layer holds your money at every step of a transaction. The upside of seamless cross-chain swaps is real — but as this week showed, the downside lives in the pipes, not the foundation.
Update — October 3, 2026: The stolen funds were returned in full on October 2 (see the timeline above), and NEAR Intents closed its investigation. The promised post-mortem is still pending; the note in this piece has been updated accordingly.
Go deeper: the Crypto Rich DeFi guide walks through how these protocols actually work, and the Learn path covers crypto fundamentals in the order that reduces mistakes. For more security-first coverage, browse the Security archive.