NEAR Intents Hit by $3.8M Exploit — Then the Attacker Returns Every Coin
Updated: Oct 15
TL;DR: A $3.8 million exploit drained a NEAR Intents hot wallet and paused services across 11 blockchains, but the attacker returned all the stolen funds within 24 hours after the team made contact.
How the exploit unfolded
On 1 October 2026, NEAR Intents was exploited for roughly $3.8 million. According to CoinDesk, a bug in the Omni deposit and withdrawal flow triggered irregular withdrawals from a hot wallet on BNB Chain.
The stolen funds were routed to KuCoin and bridged into Bitcoin, and the team halted deposits and withdrawals across all 11 chains it supports while it investigated the incident.
An unusual ending: the money came back
Then something rare happened. After the NEAR Intents team opened communication with the attacker, the exploiter voluntarily returned the entire sum within 24 hours, co-founder Illia Polosukhin confirmed.
Full voluntary recovery is unusual. It typically means either a white-hat making a point, or an attacker spooked by how traceable the funds had become. Either way, it underlines how hard laundering a large, visible sum on-chain has become in 2026.
For the protocol's users, the net financial loss was effectively zero. But the episode still exposed a live vulnerability, and the reputational cost of being breached at all does not fully reverse just because the coins came home.
An awkward reversal for the intents model
The timing is awkward. Only days earlier, NEAR Intents had blocked around $50 million linked to the Bitget hacker, positioning itself as part of the industry's defence. Losing $3.8 million of its own funds so soon after dents that narrative.
It also caps a brutal year for crypto security. Per DefiLlama, 2026 has already seen Bitget lose more than $350 million, Liquid around $320 million, Drift roughly $295 million and Kelp about $293 million. The failure point, again, was a hot-wallet bug, not exotic cryptography.
Marketing Minute's read: security is now a trust product
Our read is that security has become a trust product, not a backend checkbox. In a year this bruising, users assume protocols will be attacked; what they really judge is how a team responds.
NEAR Intents lost money, but it recovered all of it and communicated openly and quickly. That response will shape its reputation far more than the vulnerability itself.
The framework for any team shipping on-chain products: plan your incident communications before you need them. A fast, transparent response can turn a breach into a credibility win, while silence turns a small loss into a full-blown crisis.
Quick FAQ
How much was stolen from NEAR Intents?
Roughly $3.8 million was drained from a hot wallet on BNB Chain via a bug in the Omni deposit and withdrawal flow on 1 October 2026.
Did NEAR Intents get the stolen funds back?
Yes. The attacker voluntarily returned all of the funds within 24 hours after the team opened communication, according to co-founder Illia Polosukhin.
Has 2026 been a bad year for crypto hacks?
Severely. DefiLlama data shows major losses including Bitget (over $350M), Liquid (~$320M), Drift (~$295M) and Kelp (~$293M), with hot-wallet bugs a recurring cause.
What people will remember about NEAR Intents is not the bug, it's that the money came back within a day and the team talked openly the whole time. In a year this brutal for security, how you respond to an incident is doing more for your brand than any bank-grade claim on your homepage. — Daniel Nikolla, Founder of Merx Marketing
Security is a trust product, not a backend checkbox — how fast and openly you communicate during an incident now matters as much as the loss itself.
If your platform were exploited tomorrow, is your incident communications plan ready before you need it?
If you would like to know more about this topic, please contact us on danieln@merxmarketing.co.uk
Sources: CoinDesk, AMBCrypto, DefiLlama.
Related reading
Written by Daniel Nikolla, Founder of Merx Marketing Ltd and Marketing Minute
