Forensic data shows exactly how an attacker drained NEAR Intents in six hours
An attacker drained 3,865,000 USDT, about $3.87 million, from NEAR Intents’ BNB Chain vault in five withdrawals spread over roughly six hours, and the on-chain trail shows the whole operation, from two tiny test pulls to the conversion of most of the haul into bitcoin.
The sequence began on the evening of September 30, 2026, when the associated address made two test withdrawals worth 10 USDT and 11 USDT. A linked wallet had deposited 10 USDT into the vault two days earlier, in what reads as reconnaissance. The first major pull of 800,000 USDT followed at 23:54 UTC on September 30, then 1.2 million and 1.5 million USDT inside the next 56 minutes, then 330,000 USDT at 01:46 and 35,000 USDT at 06:08 UTC on October 1, per transaction data reconciled by Bitquery.
Where the money went is almost as well documented as how it left. About 76% of the stolen funds were converted into 34.69 BTC and spread across four Bitcoin wallets. Roughly $802,000 landed in deposit addresses labeled KuCoin, which blockchain investigator ZachXBT flagged independently, and nearly $90,000 sat in a Monero-linked asset on Hyperliquid. Together that accounts for about 99% of the tracked value.
The strangest detail in the data: the fraudulent withdrawals used the same message format as regular transactions, and blockchain data alone cannot explain why those requests were approved. That approval question sits at the heart of the bug NEAR Intents described in its disclosure on X, a fault in how the Omni deposit and withdrawal infrastructure interacted with the protocol’s smart contract.
The protocol paused services after the activity was flagged, patched the contract-side vulnerability within about an hour, and kept deposits and withdrawals suspended on 11 networks for roughly another 12 hours. NEAR Intents also reported the incident to law enforcement and pledged full compensation.
Tracking is also what ended the affair. Alex Shevchenko, NEAR Intents’ general manager, issued a 48-hour deadline on October 2 and published return addresses across BTC, EVM and Solana. The attacker first sent 0.295 ETH and 1 BNB with a request to communicate via Signal, then returned the funds: roughly 34.59 BTC, about $2.95 million, across five transactions to the published Bitcoin address, with the remainder routed back another way. Co-founder Illia Polosukhin confirmed the full return at 14:30 UTC on October 2 and said the team identified the responsible party in under 24 hours with support from the SHIELD AI security layer.
Who the attacker was, and why the requests were approved, has not been disclosed. The team has promised a detailed public report in the following days.
