How a Hacker Tested NEAR Intents With $10, Stole $3.87M and Moved 76% Into Bitcoin

Key Takeaways

An attacker drained about $3.87 million in USDT from a NEAR Intents-linked BNB Chain vault through five major withdrawals after first testing it with tiny transactions.
Investigators traced about 76% of the stolen value into 34.69 BTC, while roughly $802,000 reached KuCoin deposit addresses.
The exploit joins the Bitget breach, MetaMask staking incident, and FlashLoopAdapter attack in showing how crypto’s expanding integration layers are creating new security weak points.

NEAR Intents spent late September demonstrating how cross-chain infrastructure could stop hackers. Days later, the same infrastructure became the target.

On Oct. 1, NEAR Intents halted services after discovering a bug involving the interaction between its Omni deposit and withdrawal infrastructure and a NEAR Intents smart contract.

The protocol estimated losses at roughly $3.8 million, patched the contract-side vulnerability, and promised to compensate affected users in full.

Earlier today NEAR Intents services were stopped after a security incident was detected. The incident was caused by a bug in the Omni deposit and withdrawal infrastructure interaction with NEAR Intents smart contract.

The preliminary report indicates the total loss of…

— NEAR Intents (@near_intents) October 1, 2026

Onchain reconstruction by Bitquery puts the amount slightly higher at 3.865 million USDT. More unusually, the attacker did not simply drain the money and disappear.

The funds moved across multiple chains, through exchanges and swap infrastructure, into Bitcoin. About $822,000 of the stolen assets were even routed back through NEAR Intents itself while the attack was unfolding.

The incident provides a useful case study in how modern cross-chain attacks work and why securing a blockchain is no longer enough to secure everything built around it.

Try Our Recommended Crypto Exchanges

What Actually Happened to NEAR Intents?

NEAR Intents allow users to specify an outcome, such as exchanging an asset on one blockchain for another on another, while competing solvers handle execution.

That simplifies the user experience, but the underlying infrastructure still needs assets available across different networks.

The Oct. 1 attack targeted that plumbing rather than the NEAR blockchain itself.

According to NEAR Intents, the vulnerability existed in the interaction between its Omni deposit-and-withdrawal infrastructure and its smart contract. SlowMist categorizes the incident as a smart contract vulnerability.

There is currently no evidence that NEAR’s consensus mechanism or base-layer blockchain was compromised.

Bitquery reconstructed the attack from the BNB Chain vault.

The attacker appears to have prepared in advance. A wallet received BNB for gas on Sept. 28 and made a small deposit of 10 USDT. On Sept. 30, it tested withdrawals of just 10 USDT and 11 USDT.

Both worked.

Several hours later, the real drain began.

The wallet withdrew 800,000 USDT at 23:54 UTC, followed by 1.2 million USDT 30 minutes later and another 1.5 million USDT at 00:50 UTC. A 330,000 USDT withdrawal followed, before a final 35,000 USDT transaction at 06:08 UTC.

Five major withdrawals ultimately extracted $3.865 million over roughly six hours.

The sequence is instructive. Rather than immediately requesting millions, the attacker first confirmed that the withdrawal path worked by using amounts small enough to appear insignificant.

That is a common security problem beyond crypto: systems designed to detect unusually large transactions can miss tiny transactions being used to test whether an exploit is viable.

There is still an important unknown.

NEAR Intents has identified the interaction responsible for the vulnerability but, as of Oct. 2, has not published the promised full technical post-mortem explaining precisely why the unauthorized withdrawal requests were accepted.

Onchain data can show what the contracts paid. It cannot, by itself, establish the software logic that made them pay.

Where Did the $3.8M NEAR Intents Hack Funds Go?

Once the USDT was extracted, the attack became a cross-chain laundering exercise.

The attacker converted funds into BNB and distributed them among 32 newly created wallets, according to Bitquery.

From there, the money fragmented across several routes.

As of Bitquery’s Oct. 1 snapshot, 34.69 BTC, representing roughly 76% of the stolen value, was held across four Bitcoin addresses. None of those wallets had spent the Bitcoin when investigators checked them.

Majority of stolen $3.87M funds moved into Bitcoin (76%) and KuCoin (21%). | Source: Bitquery

Another approximately $802,000 was sent to KuCoin deposit addresses.

That does not establish who controls the associated exchange accounts. A blockchain investigator can identify that assets reached an exchange deposit infrastructure, but only the exchange can connect an account to customer information.

A smaller early batch worth roughly $90,000 ended up as exposure to Monero through Hyperliquid, according to Bitquery.

The routing itself was complex.

Funds passed through cross-chain and swap infrastructure, including Chainflip, THORChain, MetaMask’s bridge, and other services. Bitquery found that Chainflip completed 17 swaps before three subsequent attempts were rejected; the attacker then shifted toward THORChain.

Sequential breakdown of the exploiter's cross-chain ETH to Bitcoin swaps. — Sequential breakdown of the exploiter’s cross-chain ETH-to-Bitcoin swaps. | Source: Bitquery

But the most striking transaction path led back to NEAR Intents.

Hacker Used NEAR Intents While Hacking NEAR Intents

Around 80 minutes into the drain, the attacker sent 650 BNB through CoW Swap, requesting ETH on Ethereum.

CoW Swap’s records identified NEAR Intents as the bridging partner.

That meant funds originating from the compromised vault were effectively being deposited back into the same BNB Chain infrastructure being drained. NEAR Intents then paid the attacker 185.5 ETH on the Ethereum network.

The odd part is how the money got out.

The thief swapped about $822k of the loot through NEAR Intents itself.

750 BNB went back into the same vault while it was still being drained. NEAR Intents paid the thief in ETH and BTC. pic.twitter.com/IarE40DtfQ

— Bitquery.io ( Bloxy ) (@Bitquery_io) October 1, 2026

Another helper wallet later deposited 100 BNB, and additional transactions on Ethereum ultimately resulted in Bitcoin payouts.

Bitquery calculates that roughly $822,000, around one-fifth of the stolen funds, was processed through NEAR Intents’ own swap service during the incident.

This does not mean the service knowingly processed stolen funds. Automated cross-chain systems execute seemingly valid orders without inherently knowing the economic history of every asset.

But the sequence highlights the monitoring problem that intent-based systems face.

Security cannot stop at asking whether an individual transaction is technically valid. Cross-chain systems increasingly need to determine whether a series of individually valid transactions forms an abnormal pattern.

NEAR Had Just Helped Stop $50M Linked to the Bitget Hack

The timing makes the exploit particularly notable.

Only days earlier, NEAR co-founder Illia Polosukhin said the ecosystem’s SHIELD security infrastructure had identified more than $50 million in attempted flows through NEAR Intents connected to funds being tracked after the Bitget breach.

NEAR is permissionless programmable money.

Permissionless means nobody needs permission to own and transfer assets, or deploy contracts on NEAR.

It does not mean every application or liquidity provider must process every transaction.

SHIELD is how NEAR Intents applies this in… https://t.co/QsIFdILVbe

— Illia (root.near) (🇺🇦, ⋈) (@ilblackdragon) September 28, 2026

Bitget suffered a much larger security incident on Sept. 24. The exchange eventually revised its estimated impact to $387.5 million, including assets across Ethereum and other EVM networks, XRP Ledger, Zcash, and TRON.

Bitget’s own investigation found that attackers exploited a vulnerability in a third-party security product, obtained intranet access credentials and forged withdrawal commands that deceived its wallet system into processing abnormal transfers. Bitget said private keys and its cold wallets were not compromised.

That creates an important comparison.

The Bitget attackers reportedly attempted to use cross-chain infrastructure to move stolen assets. NEAR’s monitoring systems helped identify suspicious flows.

Yet NEAR Intents’ own incident came from a different layer: the interaction between deposit/withdrawal infrastructure and a smart contract.

A system can therefore be effective at detecting dirty money passing through it while still containing exploitable code inside its own execution stack.

Those are separate security problems.

Aave’s Latest Exploit Shows the Same Integration Risk

The Oct. 1 FlashLoopAdapter exploit provides another example.

Initial headlines described an “Aave v3 Loop Safe Module” attack, but Aave founder Stani Kulechov said the affected code was a third-party adapter built on Aave, not the core Aave v3 protocol.

SlowMist found that FlashLoopAdapter’s open() and close() functions relied on an access-control check that could be spoofed by a fake Safe contract.

🚨SlowMist TI Alert🚨

💸 @aave v3 Loop Safe Module Loss: ~114.09 ETH

🔍 Root Cause: FlashLoopAdapter's open()/close() access control only checks ISafe(msg.sender).isModuleEnabled(address(this)), which is spoofable via a fake Safe that always returns true. Its _swap() then…

— SlowMist (@SlowMist_Team) October 2, 2026

Once the fake Safe passed authentication, the attacker could manipulate the adapter’s execution path. A Morpho flash loan was used to repay Aave debt, unlock collateral, and extract weETH from two affected Safe wallets. The attacker ultimately retained approximately 114.09 ETH, worth about $305,000.

Again, the underlying protocol was not necessarily the weak point.

The weakness existed in the software connecting several components.

NEAR Intents combined Omni infrastructure, vaults, smart contracts, and cross-chain execution. FlashLoopAdapter connected Safe wallets with leveraged positions on Aave. Bitget’s attackers entered through third-party security infrastructure before reaching the exchange’s wallet system.

Different attacks, similar architectural problem: every integration creates another trust boundary.

MetaMask Shows Why Containment Matters

MetaMask’s Sept. 30 security incident offers the opposite lesson: what happens when compromised infrastructure does not provide direct access to customer principal.

MetaMask disclosed an incident affecting part of its infrastructure and proactively began exiting affected Ethereum validators. It said there was no indication that MetaMask wallets or customer funds had been affected and emphasized that its staking operation does not control customers’ withdrawal keys.

Onchain analysis by Bitquery estimated that 16,965 validators holding 565,056 ETH had exited or entered the exit queue by Oct. 1.

Yet the attacker apparently redirected only around 0.36 ETH in block tips from 18 blocks. No validators were slashed.

That outcome illustrates the value of separating operational credentials from withdrawal authority.

Compromising validator infrastructure could affect rewards and potentially validator behavior, but it did not automatically provide the attacker with keys capable of withdrawing the underlying ETH.

NEAR Intents faced a different architecture. It’s affected the BNB Chain vault, which necessarily holds liquid assets needed to facilitate cross-chain settlement. Once the withdrawal path was abused, those assets could leave immediately.

NEAR Intents Says It Has Identified the Hacker

The recovery effort took another turn on Oct. 2 when Aurora co-founder and NEAR Intents general manager Alex Shevchenko said the team had identified the person responsible.

Shevchenko publicly addressed the attacker and provided repayment addresses covering Bitcoin, BNB/Ethereum, and Solana. He gave the person 48 hours to return the funds through what he described as a responsible-disclosure process.

Alex Shevchenko's 48-hour ultimatum following the NEAR Intents exploit. — Alex Shevchenko’s 48-hour ultimatum following the NEAR Intents exploit. | Source: @AlexAuroraDev

His message described the deadline as the attacker’s final opportunity to use that route before the window closes.

However, Shevchenko did not reveal the alleged attacker’s identity, explain how the team identified them, or specify publicly what action would follow once the 48-hour deadline expires.

NEAR Intents had already said that the incident had been reported to law enforcement and that it was working with blockchain analytics firms to trace and recover the assets.

The ultimatum also changes the recovery picture. Bitquery accounted for approximately 99% of the stolen funds in its initial tracing, with most of the value still identifiable in Bitcoin wallets or at exchange-linked addresses.

For NEAR Intents, the next 48 hours will therefore test whether onchain traceability and the threat of escalation can turn a technically successful exploit into a financially unsuccessful one.

Real Lesson From the NEAR Intents Hack

The $3.8 million loss is small compared with Bitget’s $387.5 million breach.

Its architectural lesson may be more important.

Crypto security used to focus heavily on private keys and individual smart contracts. Modern infrastructure now combines wallets, bridges, solvers, vaults, APIs, relayers, authentication systems, liquidity providers, and contracts across multiple blockchains.

Each component can work correctly in isolation, while the interaction between components fails.

That is precisely how NEAR Intents described its incident.

It also explains why security controls increasingly need to operate at several levels simultaneously: contract authorization, transaction-size limits, withdrawal velocity, behavioral monitoring, cross-chain tracing and automated circuit breakers.

The NEAR attacker tested the system with $10 and $11 withdrawals before extracting millions. The vault then processed five large withdrawals over six hours. Some stolen assets were subsequently returned via NEAR Intents as swap inputs while the drain was still underway.

Those facts raise questions that the forthcoming post-mortem needs to answer: which authorization failed, what withdrawal limits were in place, when monitoring first detected abnormal activity, and whether the tiny test transactions could have provided an earlier warning.

NEAR Intents says the contract-side vulnerability has been patched, and affected users will receive full compensation.

But reimbursement resolves the balance-sheet consequence, not the engineering question.

The Bitget, FlashLoopAdapter, MetaMask, and NEAR Intents incidents all reached different parts of the crypto stack. None requires the conclusion that blockchains themselves are fundamentally insecure.

Instead, they point to the harder problem emerging as crypto infrastructure matures: the attack surface is shifting away from individual protocols and toward the growing number of connections between them.