preferred on
Points of Focus
- Near Intents said a compromised hot wallet led to roughly $3.8 million in unauthorized withdrawals, while its core contracts remained unaffected.
- The incident comes days after Near Intents intercepted $503,000 linked to the $387.5-million Bitget hack.
- Together, the cases expose the security trade-off in cross-chain systems: Smart contracts may be intact, while operational wallets and liquidity infrastructure remain attack surfaces.
Near Intents is dealing with a security incident involving more than $3.8 million in suspected unauthorized outflows, days after the cross-chain protocol played an unusual role in stopping funds stolen from Bitget.
Onchain investigator ZachXBT flagged multiple irregular withdrawals from a Near Intents hot wallet on BNB Smart Chain, identifying the suspected theft address as “0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37.”
The affected hot wallet, beginning “0x233c,” subsequently stopped processing transactions. Near Intents’ own explorer currently displays an “Ongoing Incident” for BNB Smart Chain, providing independent confirmation of disruption on the network, although Near had not published a full post-mortem establishing the attack vector at the time of writing.
Earlier today NEAR Intents services were stopped after a security incident was detected. The incident was caused by a bug in the Omni deposit and withdrawal infrastructure interaction with NEAR Intents smart contract.
The preliminary report indicates the total loss of…
— NEAR Intents (@near_intents) October 1, 2026
ZachXBT said the stolen assets were rapidly transferred to KuCoin and converted or bridged toward Bitcoin, moving the incident beyond the original BSC wallet.
That matters because it reduces the usefulness of simply monitoring the original theft address. Once assets reach an exchange and emerge as Bitcoin (BTC), investigators must follow a different transaction trail.
$30-billion system meets its operational risk
Near Intents is no longer a small experimental bridge.
Its official site reports more than $30 billion in cumulative volume across 35 chains, making the infrastructure increasingly important for moving liquidity between otherwise disconnected networks.
Cross-chain infrastructure has historically concentrated risk around bridges. Intent-based systems change that model by letting users specify an outcome while competing solvers determine how to execute it.
But abstraction does not remove every intermediary component. Liquidity providers, solvers, signing infrastructure, and operational wallets can still become points where security failures occur.
The timing makes that particularly visible.
Days after Near Intents blocked the Bitget hackers
The timing creates a striking contrast.
After Bitget lost roughly $387.5 million on Sept. 24, attackers attempted to route more than $50 million through Near Intents. Only about $669,000 reached the system: $503,000 was frozen mid-swap, while $166,000 completed.
Near Intents was effectively acting as a security checkpoint for another platform’s stolen assets.
Days later, its own hot-wallet infrastructure became the subject of suspicious outflows.
The two incidents are not evidence of the same vulnerability or attacker. Instead, they expose the two sides of cross-chain infrastructure: The same systems increasingly capable of identifying and interrupting illicit flows also maintain operational components that attackers can target directly.
For Near Intents, the $3.8-million figure is only part of the story. The more important disclosure will be how the associated wallet was compromised, what authority it had over liquidity, and whether the ongoing disruption across supported chains is precautionary or evidence of broader exposure.
Share
Most read articles
