On October 1, the attacker exploited an interaction flaw between the Omni deposit/withdrawal infrastructure and the NEAR Intents contracts to drain approximately $3.8 million from the HOT Bridge vault on the BSC
The abnormal outflows began during the night of September 30 and were completed in five transactions within about six hours, with a maximum of approximately $1.5 million per transaction
After the SHIELD security layer detected abnormal behavior, the service was paused; the contract side patched it within about an hour, and core swaps resumed. Deposits and withdrawals on 11 chains, including BSC, Polygon, TON, Optimism, and Avalanche, remained halted for 12 hours
The vulnerability was in the deposit/withdrawal permission validation, not in the NEAR consensus layer!
The destination of the stolen funds has already been determined, leaving only a very narrow window for recovery.
On-chain shows the funds were first swapped into BNB and then dispersed. ZachXBT tracked the inflow to KuCoin, after which it was bridged to Bitcoin. Bitquery's breakdown: about 76% has become Bitcoin in four wallets, about 21% reached KuCoin, and some portion completed the conversion by using NEAR Intents itself.
On October 2, Intents' CEO Alex Shevchenko said the actor had been identified and provided three refund addresses for BTC, EVM, and Solana, with a deadline of October 4.
These three addresses are empty at the time of the post. What can be frozen is only the portion still sitting on KuCoin—some has already been converted into BTC and remains unspent. You can't get the rest back just by filing a report.
Full reimbursement means the project team filled the gap with its own funds—not that the money has already been recovered. The official hasn't explained whether this money came from reserves or from revenue, nor has it provided a specific payout timetable.
The timeline is even more direct: not long ago, Intents intercepted associated hacker funds of about $50 million. Then, in turn, its own BSC treasury was breached.
Cross-chain intent routing depends on hot wallets to front the transactions. What was knocked out this time is the credit of that business—not NEAR's block production capability. Until a detailed post-mortem is compiled, market-making and deposits/withdrawals will shrink.
The price has already played out the difference.
NEAR fell from about $5.34 to $4.84, and during the day it was pushed down to $4.75—an intraday drop of over 8%. As of October 2 it was still around the $5 line, with an intraday range of roughly $4.80–$5.07.
This is profit-taking after being pulled from below $2 to $5.50 in late August—not a trend reversal. $4.75 was the low point of this dip, and $4.50–$4.60 is the structural support for this leg up. Above, $5.14 is near-term resistance; $5.34–$5.56 is the previous high before the incident. If it can't reclaim those levels, it's just a dead-cat bounce.
A $3.8 million loss relative to market value is a minor wound—you can't use it as a reason to go long, and you also can't treat it as the main-chain credit going bankrupt.
Treat moves above $4.75 as a range trade. Don't chase if the rebound can't get back above $5.14. If the daily candle closes below $4.50, only then is the structure of this uptrend considered broken; next watch around $4.20.
After the October 4 deadline, if the refund address is still empty and no payout has arrived by the time stated, the event premium will remain embedded in the price rather than fading away on its own.