NEAR Intents, a widely used cross-chain trading platform, suffered a security exploit on Thursday that caused approximately $3.8 million in losses, prompting the project to pause services and restrict deposits and withdrawals across several blockchains.

The team attributed the incident to a bug in the way its Omni deposit and withdrawal system interacted with the NEAR Intents smart contract. The contract-side vulnerability has since been patched, and the project pledged to reimburse all affected funds in full, according to a statement from NEAR Intents on X.

That reimbursement ultimately proved unnecessary. Illia Polosukhin, co-founder of NEAR Protocol, said in a Friday post on X that the exploiter returned all of the stolen assets one day after the attack, once the NEAR Intents team had identified the attacker and established communication.

How the Exploit Unfolded

Blockchain investigator ZachXBT said the exploit began with irregular withdrawals from a BNB Chain hot wallet linked to NEAR Intents. According to ZachXBT, the stolen funds were then sent to the crypto exchange KuCoin and bridged into bitcoin (BTC), which was trading at $85,032.45 at the time of writing.

NEAR Intents said it reported the incident to law enforcement and is working with security and blockchain analytics firms to trace the funds.

What NEAR Intents Does

NEAR Intents is designed to make cross-chain trading simpler. Instead of asking users to choose a bridge, an exchange or a trading route themselves, the platform lets them specify the swap they want, and independent market makers — known as solvers — compete to complete the transaction behind the scenes.

According to the platform's website, NEAR Intents has processed more than $30 billion in trading volume across 35 blockchains.

The disclosed vulnerability involved the platform's cross-chain infrastructure rather than the underlying NEAR Protocol blockchain. The episode is a reminder that in cross-chain trading, the plumbing between networks — deposit and withdrawal systems and the hot wallets that move funds — can be an attack surface in its own right, with disruptions able to cascade across many of the networks a platform serves. Even so, the incident weighed on the closely associated asset: NEAR (NEAR), the native token of the NEAR Protocol blockchain, was down about 6% over the past 24 hours at the time of writing, changing hands at $4.8116.

A Rough Year for Crypto Security

The exploit adds to what has been a difficult year for crypto security. Just last week, exchange Bitget suffered an exploit that resulted in more than $350 million in stolen assets. Other major incidents included Liquid Network at approximately $320 million, Drift at $295 million and Kelp at $293 million, according to DefiLlama data. At roughly $3.8 million, the NEAR Intents loss is a fraction of the size of those incidents.

Service Disruptions

The platform said it expected core services to resume quickly, but deposits and withdrawals on several networks were set to remain unavailable for longer while fixes were completed.

The project's status page showed issues affecting BNB Smart Chain, Polygon, TON, Optimism, Avalanche, Stellar, Monad, X Layer, ADI, Scroll and Plasma.

With the contract-side fix in place, the immediate things to watch are when deposits and withdrawals come back online across the affected networks — trackable on the status page — and any updates from the fund-tracing effort involving law enforcement and blockchain analytics firms.

Source: CoinDesk