{"investigation":{"slug":"near-intents-omni-exploit-october-2026-3-8m","entity_name":"NEAR Intents Omni Exploit October 2026 ($3.8M)","trust_score":62,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"On October 1, 2026, the NEAR Intents cross-chain swap protocol suffered a $3.8 million exploit caused by a bug in the interaction between its Omni deposit/withdrawal infrastructure and its NEAR smart contract. The vulnerability affected USDT on BNB Chain; stolen funds were routed through KuCoin and bridged to Bitcoin. The protocol patched the flaw within an hour, pledged full user compensation, subsequently identified the exploiter and issued a 48-hour return ultimatum, and ultimately confirmed full recovery of the stolen funds.","sections":[{"content":"At approximately 15:43 UTC on October 1, 2026, NEAR Intents — a cross-chain swap protocol built on NEAR Protocol — paused services after its SHIELD security system flagged unusual on-chain activity. The platform confirmed a $3.8 million loss attributable to a bug in the interaction between the Omni deposit and withdrawal infrastructure and the NEAR Intents smart contract. The affected asset was USDT on BNB Chain. NEAR Intents co-founder Illia Polosukhin and general manager Alex Shevchenko publicly confirmed the incident. Core contract-side services were reported patched and resuming within one hour of detection; deposits and withdrawals across 11 blockchain networks — including BSC, Polygon, TON, Optimism, Avalanche, Stellar, Monad, Scroll, and Plasma — remained suspended for approximately 12 additional hours while Omni infrastructure repairs were completed. This was described by Polosukhin as the first major exploit affecting the platform, which had processed over $30 billion in cumulative swap volume across 35 blockchains.","heading":"Incident Overview","sources":[{"url":"https://crypto.news/near-intents-resumes-service-after-3-8m-exploit/","name":"NEAR Intents resumes service after $3.8M exploit, pledges full compensation — crypto.news","type":"news_article","credibility":2},{"url":"https://cointelegraph.com/news/near-intents-exploit-assistance-bitget-hack","name":"NEAR Intents Hit By $3.8M Exploit In Latest Crypto Platform Hack — CoinTelegraph","type":"news_article","credibility":2},{"url":"https://decrypt.co/379822/near-intents-hacked-days-after-denying-bitget-hacker","name":"Near Intents Hacked for $3.8M Days After Denying North Korea-Linked Bitget Hacker — Decrypt","type":"news_article","credibility":2}],"severity":"high"},{"content":"The exploit stemmed from a flaw in the integration between the Omni deposit and withdrawal layer and the upper-level NEAR Intents smart contract. According to Polosukhin, the vulnerability did not reside in a single isolated contract but rather in how the handover between the two components was handled, allowing an attacker to drain a BNB Chain hot wallet. The team patched the contract-side flaw within one hour of detection. Polosukhin committed to publishing a full post-mortem and implementing formal verification for NEAR contracts. He acknowledged that operating at a $4 billion monthly volume requires a higher security standard than had been applied.","heading":"Technical Vulnerability","sources":[{"url":"https://crypto.news/near-intents-resumes-service-after-3-8m-exploit/","name":"NEAR Intents resumes service after $3.8M exploit, pledges full compensation — crypto.news","type":"news_article","credibility":2},{"url":"https://protos.com/near-intents-hacked-days-after-freezing-stolen-bitget-funds/","name":"NEAR Intents hacked days after freezing stolen Bitget funds — Protos","type":"news_article","credibility":2}],"severity":"high"},{"content":"Blockchain investigator ZachXBT documented irregular outflows from NEAR Intents' BSC hot wallet shortly after the attack. According to ZachXBT's analysis, the stolen USDT was immediately transferred to the KuCoin exchange and subsequently bridged into Bitcoin. Bitquery also traced fund movements across multiple blockchain networks. Three recovery wallet addresses were later published by Shevchenko — one each for Bitcoin, BNB, and Solana — as part of the 48-hour return ultimatum.","heading":"Fund Movement and On-Chain Tracing","sources":[{"url":"https://protos.com/near-intents-hacked-days-after-freezing-stolen-bitget-funds/","name":"NEAR Intents hacked days after freezing stolen Bitget funds — Protos","type":"news_article","credibility":2},{"url":"https://decrypt.co/379822/near-intents-hacked-days-after-denying-bitget-hacker","name":"Near Intents Hacked for $3.8M Days After Denying North Korea-Linked Bitget Hacker — Decrypt","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/10/02/near-intents-gm-says-3-8m-exploiter-identified-sets-48-hour-return-deadline/","name":"NEAR Intents GM Says $3.8M Exploiter Identified, Sets 48-Hour Return Deadline — CryptoTimes","type":"news_article","credibility":2}],"severity":"high"},{"content":"On October 2, 2026, NEAR Intents general manager Alex Shevchenko announced via X that the protocol had identified the exploiter, stating 'We have identified you, sir.' The method of identification was not publicly disclosed. Shevchenko issued a 48-hour ultimatum under the protocol's responsible disclosure policy, providing three wallet addresses for returning funds in Bitcoin, BNB, and Solana. He told the alleged attacker: 'You know better than most how responsible disclosure works — this is the last window to use it. After 48 hours, that window closes.' On or around October 2 (UTC+8), the exploiter's address sent 1 BNB to a recovery wallet accompanied by a message offering cooperation and requesting Signal contact details; a prior message from the same address had included 0.295 ETH. The hacker's identity was not publicly disclosed at any point. The incident was reported to law enforcement, and the protocol engaged security and blockchain analytics partners.","heading":"Attacker Identification and Ultimatum","sources":[{"url":"https://cointelegraph.com/news/near-intents-says-its-identified-the-hacker-gives-48-hour-ultimatum","name":"NEAR Intents Gives $3.8M Hacker 48-Hour Ultimatum — CoinTelegraph","type":"news_article","credibility":2},{"url":"https://kucoin.com/news/flash/near-intents-hacker-offers-cooperation-transfers-1-bnb-with-message","name":"NEAR Intents Hacker Offers Cooperation, Transfers 1 BNB with Message — KuCoin News","type":"news_article","credibility":2},{"url":"https://beincrypto.com/near-intents-hacker-identified-48-hours/","name":"NEAR Intents Hacker Identified: Will $3.8M Return in 48 Hours? — BeInCrypto","type":"news_article","credibility":2}],"severity":"high"},{"content":"NEAR Intents general manager Alex Shevchenko subsequently confirmed that the full $3.8 million in stolen funds had been returned. The protocol declared the incident resolved and halted its investigation. No court ruling was made on the merits of any claim, and no formal charges or regulatory findings related to this incident have been publicly reported as of the investigation date. User compensation using treasury funds had been pledged regardless of recovery; with the funds returned, the protocol indicated affected users' internal ledger balances would reflect pre-exploit amounts following accounting adjustments.","heading":"Fund Recovery and Resolution","sources":[{"url":"https://phemex.com/news/article/near-intents-recovers-38m-in-hack-funds-ends-investigation-98638","name":"NEAR Intents Recovers $3.8M Hack Funds, Investigation Ends — Phemex","type":"news_article","credibility":2},{"url":"https://crypto.news/near-intents-resumes-service-after-3-8m-exploit/","name":"NEAR Intents resumes service after $3.8M exploit, pledges full compensation — crypto.news","type":"news_article","credibility":2}],"severity":"low"},{"content":"Approximately two days before the NEAR Intents exploit, the NEAR Intents platform had blocked a $50 million swap attempt linked to the alleged perpetrators of a separate $387.5 million breach of the Bitget exchange. Bitget CEO Gracy Chen stated that North Korean hackers may have been responsible for that prior exchange-level attack. NEAR Intents froze approximately $503,000 in funds connected to that incident and allowed approximately $166,000 through. No confirmed link between the Bitget hack actors and the subsequent NEAR Intents exploit has been established. The proximity of the two events was widely noted in coverage, but attributing the NEAR Intents exploit to North Korean actors or to Bitget's alleged attackers is not supported by available evidence.","heading":"Preceding Bitget Incident Context","sources":[{"url":"https://www.techflowpost.com/en-US/article/34343","name":"NEAR Intents Hacked: Intercepted $50M in Hacker Funds Last Week — TechFlowPost","type":"news_article","credibility":2},{"url":"https://decrypt.co/379822/near-intents-hacked-days-after-denying-bitget-hacker","name":"Near Intents Hacked for $3.8M Days After Denying North Korea-Linked Bitget Hacker — Decrypt","type":"news_article","credibility":2},{"url":"https://protos.com/near-intents-hacked-days-after-freezing-stolen-bitget-funds/","name":"NEAR Intents hacked days after freezing stolen Bitget funds — Protos","type":"news_article","credibility":2}],"severity":"medium"},{"content":"Following public disclosure of the exploit, the NEAR token declined approximately 7.5–8.93% within minutes, reaching a low of approximately $4.76 before partially recovering to around $4.84–$4.86. NEAR ETF shares also reportedly dropped over 7%. The token had been trading near $5.10 prior to the incident.","heading":"Market Impact","sources":[{"url":"https://www.tradingview.com/news/u_today:812a5672f094b:0-near-intents-breaks-silence-on-3-8-million-exploit-near-token-slumps-7-5/","name":"Near Intents Breaks Silence on $3.8 Million Exploit, NEAR Token Slumps 7.5% — TradingView / U.Today","type":"news_article","credibility":2},{"url":"https://beincrypto.com/near-intents-hacked-3-8-million/","name":"NEAR Intents Hacked for $3.8 Million: Is NEAR Protocol Safe? — BeInCrypto","type":"news_article","credibility":2}],"severity":"medium"}],"timeline":[{"date":"2026-09-29","event":"Bitget exchange suffered an approximately $387.5 million breach; Bitget CEO Gracy Chen alleged North Korean actors may have been responsible.","source":"Decrypt","source_url":"https://decrypt.co/379822/near-intents-hacked-days-after-denying-bitget-hacker"},{"date":"2026-09-29","event":"NEAR Intents blocked a $50 million swap attempt linked to the suspected Bitget hack perpetrators, freezing approximately $503,000.","source":"Protos","source_url":"https://protos.com/near-intents-hacked-days-after-freezing-stolen-bitget-funds/"},{"date":"2026-10-01","event":"NEAR Intents SHIELD security system flagged unusual activity; approximately $3.8 million in USDT drained from BSC hot wallet via Omni deposit/withdrawal vulnerability; services paused across 11 networks.","source":"crypto.news","source_url":"https://crypto.news/near-intents-resumes-service-after-3-8m-exploit/"},{"date":"2026-10-01","event":"ZachXBT traced stolen funds to KuCoin exchange, then bridged to Bitcoin.","source":"Protos","source_url":"https://protos.com/near-intents-hacked-days-after-freezing-stolen-bitget-funds/"},{"date":"2026-10-01","event":"NEAR Intents co-founder Illia Polosukhin confirmed the vulnerability was patched within one hour; pledged full user compensation and formal post-mortem; incident reported to law enforcement.","source":"crypto.news","source_url":"https://crypto.news/near-intents-resumes-service-after-3-8m-exploit/"},{"date":"2026-10-01","event":"NEAR token fell approximately 7.5–8.93%, reaching a low of roughly $4.76.","source":"U.Today / TradingView","source_url":"https://www.tradingview.com/news/u_today:812a5672f094b:0-near-intents-breaks-silence-on-3-8-million-exploit-near-token-slumps-7-5/"},{"date":"2026-10-02","event":"NEAR Intents GM Alex Shevchenko announced the exploiter had been identified and issued a 48-hour ultimatum to return funds, providing three recovery wallet addresses.","source":"CoinTelegraph","source_url":"https://cointelegraph.com/news/near-intents-says-its-identified-the-hacker-gives-48-hour-ultimatum"},{"date":"2026-10-02","event":"Exploiter's address sent 1 BNB (and earlier 0.295 ETH) to a recovery wallet with a message offering cooperation and requesting Signal contact details.","source":"KuCoin News","source_url":"https://kucoin.com/news/flash/near-intents-hacker-offers-cooperation-transfers-1-bnb-with-message"},{"date":"2026-10-02","event":"NEAR Intents confirmed full recovery of the $3.8 million in stolen funds; declared the incident resolved and halted further investigation.","source":"Phemex","source_url":"https://phemex.com/news/article/near-intents-recovers-38m-in-hack-funds-ends-investigation-98638"}],"sources_used":[{"url":"https://crypto.news/near-intents-resumes-service-after-3-8m-exploit/","name":"NEAR Intents resumes service after $3.8M exploit, pledges full compensation — crypto.news","type":"news_article","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://cointelegraph.com/news/near-intents-exploit-assistance-bitget-hack","name":"NEAR Intents Hit By $3.8M Exploit In Latest Crypto Platform Hack — CoinTelegraph","type":"news_article","archive_url":"https://web.archive.org/web/20261002175308/https://cointelegraph.com/news/near-intents-exploit-assistance-bitget-hack","credibility":2,"archive_timestamp":"2026-10-02T17:53:08+00:00"},{"url":"https://decrypt.co/379822/near-intents-hacked-days-after-denying-bitget-hacker","name":"Near Intents Hacked for $3.8M Days After Denying North Korea-Linked Bitget Hacker — Decrypt","type":"news_article","archive_url":"http://web.archive.org/web/20261001205527/https://decrypt.co/379822/near-intents-hacked-days-after-denying-bitget-hacker","credibility":2,"archive_timestamp":"2026-10-01T20:55:27+00:00"},{"url":"https://protos.com/near-intents-hacked-days-after-freezing-stolen-bitget-funds/","name":"NEAR Intents hacked days after freezing stolen Bitget funds — Protos","type":"news_article","archive_url":"http://web.archive.org/web/20261001221046/https://protos.com/near-intents-hacked-days-after-freezing-stolen-bitget-funds/","credibility":2,"archive_timestamp":"2026-10-01T22:10:46+00:00"},{"url":"https://cointelegraph.com/news/near-intents-says-its-identified-the-hacker-gives-48-hour-ultimatum","name":"NEAR Intents Gives $3.8M Hacker 48-Hour Ultimatum — CoinTelegraph","type":"news_article","archive_url":"https://web.archive.org/web/20261002175446/https://cointelegraph.com/news/near-intents-says-its-identified-the-hacker-gives-48-hour-ultimatum","credibility":2,"archive_timestamp":"2026-10-02T17:54:46+00:00"},{"url":"https://kucoin.com/news/flash/near-intents-hacker-offers-cooperation-transfers-1-bnb-with-message","name":"NEAR Intents Hacker Offers Cooperation, Transfers 1 BNB with Message — KuCoin News","type":"news_article","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://beincrypto.com/near-intents-hacker-identified-48-hours/","name":"NEAR Intents Hacker Identified: Will $3.8M Return in 48 Hours? — BeInCrypto","type":"news_article","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://phemex.com/news/article/near-intents-recovers-38m-in-hack-funds-ends-investigation-98638","name":"NEAR Intents Recovers $3.8M Hack Funds, Investigation Ends — Phemex","type":"news_article","archive_url":"https://web.archive.org/web/20261002180222/https://phemex.com/news/article/near-intents-recovers-38m-in-hack-funds-ends-investigation-98638","credibility":2,"archive_timestamp":"2026-10-02T18:02:22+00:00"},{"url":"https://www.techflowpost.com/en-US/article/34343","name":"NEAR Intents Hacked: Intercepted $50M in Hacker Funds Last Week — TechFlowPost","type":"news_article","archive_url":"http://web.archive.org/web/20261001184407/https://www.techflowpost.com/en-US/article/34343","credibility":2,"archive_timestamp":"2026-10-01T18:44:07+00:00"},{"url":"https://www.tradingview.com/news/u_today:812a5672f094b:0-near-intents-breaks-silence-on-3-8-million-exploit-near-token-slumps-7-5/","name":"Near Intents Breaks Silence on $3.8 Million Exploit, NEAR Token Slumps 7.5% — TradingView / U.Today","type":"news_article","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://www.cryptotimes.io/2026/10/02/near-intents-gm-says-3-8m-exploiter-identified-sets-48-hour-return-deadline/","name":"NEAR Intents GM Says $3.8M Exploiter Identified, Sets 48-Hour Return Deadline — CryptoTimes","type":"news_article","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://beincrypto.com/near-intents-hacked-3-8-million/","name":"NEAR Intents Hacked for $3.8 Million: Is NEAR Protocol Safe? — BeInCrypto","type":"news_article","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://finance.yahoo.com/markets/crypto/articles/near-intents-hacked-3-8m-154327641.html","name":"Near Intents Hacked for $3.8M Days After Denying North Korea-Linked Bitget Hacker — Yahoo Finance","type":"news_article","archive_url":"https://web.archive.org/web/20261002175802/https://finance.yahoo.com/markets/crypto/articles/near-intents-hacked-3-8m-154327641.html","credibility":2,"archive_timestamp":"2026-10-02T17:58:02+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-10-02T17:07:52.210249+00:00","updated_at":"2026-10-02T18:10:03.779692+00:00"},"source_quality":{"total":13,"tier1":0,"tier2":3,"tier3":0,"unrated":10},"follower_count":null}