Near Intents Halts Cross-Chain Swaps After $3.8M Exploit, Pledges Full User Reimbursement

A vulnerability in the cross-chain infrastructure powering Near Intents allowed an attacker to siphon approximately $3.8 million on Thursday, forcing the protocol to suspend operations across 11 blockchains and sending its native token sharply lower just days after a major institutional milestone.

The exploit targeted the Omni layer, the middleware responsible for routing deposits and withdrawals between Near Intents’ core smart contracts and external networks. While the primary swapping mechanism was patched within an hour of detection, bridging services connecting to BNB Chain, Polygon, Optimism, and eight other networks remained offline for roughly 12 hours as engineers secured the broader architecture.

On-chain investigator ZachXBT tracked the stolen funds through KuCoin before they were bridged into Bitcoin, a laundering technique increasingly favored by sophisticated threat actors seeking to obscure transaction trails across incompatible ledgers. Near Intents confirmed it has engaged law enforcement and blockchain analytics firms to pursue recovery, though converting illicit gains into Bitcoin via centralized exchanges typically triggers Know Your Customer protocols that can freeze assets if flagged quickly enough.

Unlike traditional financial institutions, decentralized protocols do not carry FDIC-style deposit insurance. When bridge contracts are drained, users typically absorb the loss permanently. Near Intents broke from this industry precedent by committing to fully compensate affected users from its own reserves. The protocol has processed more than $30 billion in swaps across 35 blockchains since inception, operating as an intent-based marketplace where competing market makers bid to fulfill user trade requests rather than relying on static automated market maker liquidity pools.

The timing compounds pressure on the NEAR ecosystem. Just 48 hours before the breach, Near Intents publicly blocked a $50 million swap attempt originating from the wallet of the Bitget hacker, who stole roughly $387.5 million from the exchange last week. Blockchain intelligence firm Elliptic and Bitget CEO Gracy Chen have attributed that theft to North Korean state-sponsored operatives, though definitive confirmation remains pending. Investigators have not established whether Thursday’s Omni exploit is connected to the same actors or represents an opportunistic strike by a separate entity capitalizing on heightened network activity.

Market reaction was immediate. The NEAR token dropped nearly 9% to $4.86. The sell-off also dragged down shares of the Bitwise NEAR ETF, which fell more than 7%. Bitwise launched the exchange-traded fund on Tuesday, marking the first time traditional brokerage investors could gain spot exposure to the token without managing private keys. The asset manager originally filed for the product in April 2025 when NEAR traded at $2.61, meaning the token had nearly doubled in value leading up to the launch before the security incident triggered a reversal.

Cross-chain bridges remain the most heavily targeted attack surface in decentralized finance. Because these systems require locking massive amounts of collateral in intermediary smart contracts to facilitate transfers between isolated blockchains, they function as high-value honeypots. The sector has suffered catastrophic losses over the past four years, most notably the Ronin Network breach in 2022 that cost $625 million and the Harmony Horizon bridge exploit later that year, which resulted in a $100 million theft. Unlike standard smart contract bugs that affect a single chain, bridge vulnerabilities expose capital pooled across multiple ecosystems simultaneously.

Near Intents stated that a comprehensive post-mortem report detailing the technical root cause of the Omni interaction failure will be published in the coming days.