NEAR Intents said on Thursday that a bug led to a loss of about $3.8 million at the cross-chain trading protocol, but that the full amount will be covered. It did not say whose funds were lost.
The team said it halted the protocol when it detected a security incident. It traced the problem to “a bug in the Omni deposit and withdrawal infrastructure interaction with NEAR Intents smart contract.”
“The preliminary report indicates the total loss of approximately $3.8M,” the team wrote on X. “These funds will be compensated in full.”
In the post, published at 8:53 a.m. ET, the team said it had fixed the flaw on the contract side and expected to be operating again within an hour. It said 11 networks, including BNB Chain, Polygon, TON, Optimism and Avalanche, would go without deposits and withdrawals for roughly 12 more hours while it finishes repairing the Omni infrastructure. People with assets from those networks held in HOT Wallet or on near.com can convert them to other assets as soon as the protocol itself is running, the team said.
Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.
Most Funds Left in Six Hours
NEAR Intents did not name the affected contract. Onchain investigator ZachXBT identified a BNB Chain address that he said received the funds. Blockchain data reviewed by Unchained shows that address collected about 3.87 million USDT from a contract that NEAR Intents’ documentation lists as the HOT Bridge treasury address on BNB Chain.
Two transfers on Wednesday afternoon moved 10 USDT and 11 USDT. Five larger ones, ranging from 35,000 USDT to 1.5 million USDT, followed between 7:54 p.m. ET on Wednesday and 2:08 a.m. on Thursday. In all seven, the receiving address triggered the withdrawal itself. In the other withdrawals from the contract that Unchained reviewed, a different address processed the payout.
Tracing the Funds
The receiving address sent nearly all of the USDT onward within minutes of each transfer, the data shows. About 1.5 million USDT went to the settlement contract of CoW Protocol, a decentralized trading protocol, and the rest to four addresses Unchained has not identified. ZachXBT wrote that the funds “were immediately transferred to Kucoin and bridged to Bitcoin.” Unchained could not independently confirm those destinations.
NEAR Intents said it has notified law enforcement and brought in security and blockchain analytics firms to follow the money and try to recover it.
The HOT Bridge treasury contract kept processing other withdrawals on Thursday, the data shows. Shortly after 9:27 a.m. ET it paid about 215,000 USDT to an address that has drawn six-figure sums from it repeatedly over at least the past month.
The incident came days after NEAR Intents general manager Alex Shevchenko said attackers had tried to push more than $50 million from the Bitget hack through the protocol. He said roughly $166,000 of that slipped through and another $503,000 was frozen.
The team said it will publish a fuller account “in the following days.”
Related Listen: How Bitget Is Chasing $388 Million in Stolen Funds After a Zero-Day Hack
