Key Takeaways
- NEAR Intents estimates roughly $3.8 million was lost through an Omni infrastructure bug.
- ZachXBT says stolen NEAR Intents funds reached Kucoin before being bridged to Bitcoin.
- NEAR Intents says affected users will be compensated and a detailed report will follow.
NEAR Intents discovered a $3.8 million hole Thursday morning and pulled the brakes. A flaw in the machinery connecting its Omni deposit and withdrawal infrastructure with the NEAR Intents smart contract had been exploited, forcing the service and near.com offline.
Except there was a problem. The money wasn’t sitting around waiting for engineers to fix the bug. ZachXBT said the funds were already moving, turning a software failure into a live chase across blockchains.
A Bug Opens a $3.8 Million Door
The NEAR Intents team said, “The preliminary report indicates the total loss of approximately $3.8M. These funds will be compensated in full.”
In plain English, the weak point sat where two pieces of the system talked to each other. NEAR Intents said the contract-side vulnerability has since been patched and estimated its core services would resume within roughly an hour.
But the wider plumbing isn’t fixed yet. Deposits and withdrawals involving BSC, Polygon, TON, Optimism, Avalanche, Stellar, Monad, LayerX, Adi, Scroll and Plasma are expected to remain unavailable for about 12 additional hours while the Omni infrastructure is repaired.
Then the Money Started Running
Here’s the wait, what? Onchain sleuth ZachXBT said the BSC hot wallet recorded several irregular outflows before processing stopped.
“The funds were immediately transferred to Kucoin and bridged to Bitcoin,” the investigator wrote. That means roughly $3.8 million went from an infrastructure bug to an onchain pursuit spanning an exchange and Bitcoin before the incident had finished unfolding publicly.
Users Get Paid, Investigators Get a Trail
NEAR Intents says affected funds will be compensated in full. Users holding assets from the temporarily disabled chains inside NEAR Intents, including through HOT Wallet or near.com, should still be able to swap them once the main service returns.
The team has reported the incident to law enforcement and brought in security and blockchain analytics partners to trace the money. A detailed report is promised in the coming days.
The bug is patched. The missing $3.8 million, however, is already somewhere else. This story is ongoing and may be updated with future findings.