NEAR Intents (Omni deposit and withdrawal bug) hack — September 2026

NEAR Intents, a cross-chain trading service in the NEAR ecosystem in which independent market makers called solvers fill users' swaps, lost about $3.8m from the vault on BNB Chain that holds deposits for its Omni deposit and withdrawal system, in withdrawals made between the evening of 30 September and the morning of 1 October 2026. According to an on-chain investigation by Bitquery, a wallet linked to a 10 USDT deposit made two days earlier withdrew 10 and 11 USDT as tests at 18:57 and 20:05 UTC on 30 September, then 800,000 USDT at 23:54 UTC, followed by 1.2m, 1.5m, 330,000 and 35,000 USDT between 00:24 and 06:08 UTC on 1 October: 3,865,000 USDT in five withdrawals, each carrying a signed withdrawal note in the same form as ordinary users' withdrawals. NEAR Intents said the cause was a bug in how its Omni deposit and withdrawal infrastructure interacted with the Intents smart contract, and NEAR co-founder Illia Polosukhin said the loss was confined to USDT on BNB Chain. NEAR Intents' SHIELD monitoring system flagged the activity and the service was paused; NEAR Intents confirmed the incident at about 12:53 UTC on 1 October. The team said it patched the contract-side vulnerability within about an hour, while deposits and withdrawals on eleven networks, including BNB Chain, Polygon, TON and Optimism, stayed closed for roughly twelve more hours until the Omni infrastructure was fixed. The NEAR blockchain and the NEAR token were not affected.

The $3.8m is NEAR Intents' preliminary figure and is the amount recorded, with Bitquery's on-chain count of 3,865,000 USDT kept as the upper end; the detailed report NEAR Intents promised had not been published by 4 October. By Bitquery's tracing, the USDT was swapped to BNB and spread across 32 fresh wallets, and about a fifth of it, some $822,000, was swapped through NEAR Intents' own service while the vault was still paying out. About $802,000 reached KuCoin deposit addresses, about $90,000 was turned into a Monero token on Hyperliquid, and by the afternoon of 1 October 34.69 BTC, 76% of the total, sat unspent in four bitcoin wallets; the investigator ZachXBT had likewise reported the funds going to KuCoin and into bitcoin. NEAR Intents pledged to compensate affected users in full and reported the incident to law enforcement. Early on 2 October its general manager, Alex Shevchenko, said the team had identified the person responsible, published addresses on Bitcoin, on BNB Chain and Ethereum, and on Solana for the funds to be sent back to, and set a 48-hour deadline. He then posted messages addressed to the attacker, encrypted so that only the holder of the theft address's key could read them.

Later on 2 October Shevchenko said the funds had been sent back in full and the investigation was closed, and Polosukhin said the recovery was complete at 14:30 UTC. The Bitcoin return address received 34.59 BTC in four transfers between 14:31 and 15:05 UTC, worth about $2.99m at the time, which this registry read from the chain; NEAR Intents has not said how the remaining $0.8m or so came back. At 16:15 UTC the theft address on BNB Chain sent the return address a small payment carrying a message that all the funds had been returned and that the sender had been in the wrong. The incident is recorded as funds returned, at the full amount NEAR Intents states. No one has been publicly named.