NEAR Intents Halts After a Multimillion-Dollar Exploit

Three crypto newsrooms on 1 October described the same halt at a NEAR-linked service after a bug opened a hole between deposit plumbing and a smart contract. The NEAR Intents 3.8 million exploit October 1 2026 is the figure The Block, Decrypt, and CoinDesk all used: about $3.8 million taken. The team said the contract bug was patched and that losses would be compensated in full.

What happened

NEAR Intents halted on Thursday after the loss. The outlets published on 1 October, and Thursday of that week is 1 October 2026. They say the money was taken via a bug in how the Omni deposit and withdrawal infrastructure interacted with the NEAR Intents smart contract. A smart contract is code on a chain that moves assets when its conditions are met.

Deposit and withdrawal infrastructure is the machinery that takes assets in and sends them out. The bug, as the three outlets describe it, sat in the interaction between those two pieces. It is not described here as a vague intrusion with no location. The Block's story is here.

The team's account, as the outlets report it, has several parts, and they are not all the same kind of statement. It said the contract bug was patched, which is a claim about the code now. It said losses would be compensated in full, which is a promise to make users whole, not a report that every dollar has already been paid. It said core services were expected back within about an hour.

Deposits and withdrawals on 11 networks, including BSC, also called BNB Chain, Polygon, and Optimism, would stay down for about 12 hours. That is a longer outage than the core-services line, and it is limited to deposits and withdrawals. Eleven is the count. The three names are included in the eleven, not offered as the whole list.

The team said it contacted law enforcement and analytics firms and that it would publish a post-mortem. Law enforcement can investigate a theft. Analytics firms, in this setting, trace assets on chains.

A post-mortem is a later written account of what broke. Contacted, and would publish, are not the same as a finished case or a published report.

ZachXBT said the funds went to KuCoin and were bridged to bitcoin. All three outlets report that. Bridged means the value was moved toward bitcoin using a bridge, a tool that carries assets across chains.

KuCoin is the venue he named. The outlets are reporting his account, not a separate exchange confirmation in the facts used here.

Decrypt's report is here. CoinDesk's is here.

Why it matters

The location of the bug keeps the story from becoming a generic theft item. Omni's deposit and withdrawal infrastructure interacted badly with the NEAR Intents smart contract. Money moved because two systems that are supposed to hand assets across a boundary did not constrain each other. A patch to the contract is the team's stated response.

Compensation in full is still a statement of intent in these reports. "In full" means the team said the loss would be covered, not discounted. "Would be" means later.

Readers who treat the sentence as "everyone has been paid" are ahead of the 1 October record. About $3.8 million is the scale all three outlets give, and the "about" should stay.

The two clocks are easy to mash together. Core services expected back within about an hour is not the same outage as deposits and withdrawals on 11 networks staying down for about 12 hours. A service can look up for some uses and still refuse deposits and withdrawals. BSC, or BNB Chain, Polygon, and Optimism are the three networks named inside the eleven.

Calling law enforcement and analytics firms, and promising a post-mortem, is the trail the team described. It does not identify an attacker in these facts. The tracing claim that is sourced is ZachXBT's: funds went to KuCoin and were bridged to bitcoin, as relayed by all three outlets.

A bridge changes the form of the asset. It does not, by itself, name who controls the bitcoin.

No token price is part of this account. The outlets did not agree on price prints, and none is stated here. The loss figure they did share is about $3.8 million. That is a loss figure, not a market quote for NEAR or for any other token.

Related: Bitget zero-day and MetaMask Lido incident.

What's next

The team's own sequence is the near-term list. The contract is patched, on the team's say-so. Compensation in full is still framed as what will be done.

Core services were expected within about an hour. Deposits and withdrawals on the 11 networks were to stay down for about 12 hours. A post-mortem was still to be published.

Whether those clocks elapsed as expected is not something the 1 October articles, as used here, confirm after the fact. They report the expectation and the planned downtime. A later update would be a different story. Until then, the clocks stay in the tense the team used.

ZachXBT's path, KuCoin and then bitcoin, is the tracing lead all three outlets carried. It is a lead about where funds moved, not a recovery announcement. Compensation in full, if it happens, would be a team payment to users. It is not the same event as coins coming back from an exchange.

What the day established is a halt, a located bug, a patch the team says is in, and a loss of about $3.8 million. It also established a promise to make that loss good, a short wait for core services, a longer wait on 11 networks, and a trace that ends, on ZachXBT's account, in bitcoin after KuCoin.