NEAR Intents Hit by $3.8M Exploit via Omni Bridge Bug

NEAR Intents, the cross-chain swap service built on NEAR Protocol, lost about $3.8 million on 1 October 2026 after an attacker exploited a bug in how its Omni deposit and withdrawal infrastructure interacted with the NEAR Intents smart contract.

The team halted services once the incident was detected, patched the contract-side flaw, and promised to repay affected users in full.

NEAR Intents lets users and AI agents state the swap they want, such as a token on one blockchain for a token on another, and leaves outside market makers to compete to fill it. Omni is the bridge layer that moves assets in and out of that system. According to the team’s preliminary report, the bug sat in the handoff between the two, and neither NEAR’s statement nor on-chain investigators have pointed to any loss on NEAR Protocol’s base layer.

“These funds will be compensated in full,” NEAR Intents said. The company expected NEAR Intents and near.com to come back online within about an hour, but deposits and withdrawals on 11 networks will stay unavailable for roughly 12 more hours while fixes to the Omni infrastructure are completed: BNB Smart Chain (BSC), Polygon, TON, Optimism, Avalanche, Stellar, Monad, LayerX, Adi, Scroll, and Plasma.

Users holding assets from those chains inside NEAR Intents, for example, through HOT Wallet or near.com, do not need to move anything. They will be able to swap those holdings into other assets once the core service resumes, the team said.

On-chain investigator ZachXBT, who flagged the attack, said NEAR Intents’ hot wallet on BSC, the online wallet used to pay out withdrawals, saw several abnormal outflows before it stopped processing transactions. He put the theft at more than $3.8 million and said the stolen funds were sent to the KuCoin exchange and then bridged to Bitcoin. KuCoin has not said publicly whether it froze any of the deposits.

NEAR Intents said it has reported the incident to law enforcement and is working with security and blockchain analytics partners to trace the funds and pursue recovery. The Omni Bridge is already covered by a public bug bounty on HackenProof, which rates smart-contract flaws in the bridge as critical and pays up to $100,000 for them. NEAR Intents has not said whether the exploited bug was ever reported through that program.

The NEAR token fell 8.6% to $4.92 within hours, BeInCrypto reported, two days after Bitwise launched the first US spot NEAR exchange-traded fund (ETF). Bitwise pitched that fund partly on NEAR Intents, which it says has processed more than $32 billion in swaps. The exploit is the second significant one in the NEAR ecosystem this year, after Rhea Finance lost $7.6 million in April.

Days after blocking the Bitget hackers

NEAR Intents was on the other side of a crypto theft only last week. After attackers drained Bitget on 24 September, NEAR Intents’ SHIELD risk-monitoring layer flagged more than $50 million in attempted laundering flows through the protocol and froze $503,000 mid-execution, Aurora co-founder Alex Shevchenko said on 28 September. Bitget CEO Gracy Chen publicly thanked the team, writing that “more protocols should take notes.” Three days later, it was NEAR Intents’ own wallet being emptied.

The exploit caps a difficult week for crypto security. Bitget initially put its hot wallet loss at $351.6 million, a figure since revised to about $387.5 million, and investigators from Mandiant and SlowMist have traced the intrusion to zero-day exploits in two third-party security appliances. On 30 September, MetaMask disclosed a security incident affecting part of its infrastructure and began exiting Ethereum validators in its staking business, while saying it had found no immediate threat to MetaMask wallets. Nothing made public so far links the three incidents, which involve different systems and different points of failure.

Several questions remain open. NEAR Intents has not explained how the attacker triggered the Omni bug, whether any stolen funds have been frozen, or how the full compensation will be funded. The team said a detailed public report will follow in the coming days.