NEAR Intents was recently reported to be involved in a $3.8 million exploit, with reports also claiming that the attacker had returned the funds. At almost the same time, the market was discussing NEAR’s integration with Solana through Sunrise, as well as NEAR’s addition to a newly launched perpetuals market. The narrative of expanding product coverage is unfolding alongside a security incident, making the key question for this market cycle more concrete: Can cross-chain usage grow, and can security mechanisms withstand that growth?

So far, the exploit amount, the return of funds, and the integration details lack technical explanations or transaction records that can be independently cross-checked. The claim that the funds were “returned” also does not, by itself, mean the incident is resolved. This information should be treated as unverified reports, not as a complete post-incident review.

In the same rally, the market was not trading on the same thing

In public discussions on October 16–17, NEAR’s 24-hour gain was variously described as nearly 10%, more than 12%, and more than 15%. These figures refer to different observation windows; they cannot be combined into one continuous price move, nor do they establish the latest price. What they broadly agree on is that NEAR had rebounded significantly and the market was trying to explain why.

The explanations largely fall into three lines of thought. The first is product-related: NEAR Intents, chain abstraction, and cross-chain operations were mentioned repeatedly, while news that Sunrise was integrating with Solana further reinforced the idea of reaching more networks. The second concerns capital: some claimed that related funds had seen inflows, prompting discussion about new demand through traditional investment channels. The third concerns positioning: some said NEAR futures saw about $5.47 million in liquidations over 24 hours, including roughly $3.70 million in short liquidations, and argued that short covering had amplified the pace of the rally.

The evidence behind these three explanations varies in strength. News of the integration has so far appeared mainly in brief reports and is not enough to establish actual usage. The amount of fund inflows and the methodology used to calculate them lack independent verification. Liquidation figures have been repeated across multiple discussions, but may come from the same original data; repetition does not amount to confirmation from multiple sources. In particular, buying driven by short positions being closed is not the same as sustained inflows of spot-market capital. Both can contribute to a price rise, but they have different implications for what happens next.

The opportunity presented by Intents also means security concerns cannot be overlooked

The product narrative behind NEAR Intents is that users can express their transaction goals without having to handle every step themselves across different networks. If these workflows genuinely make cross-chain transactions less complex, connecting to more networks and markets could expand the demand the product can serve. However, wider coverage is not the same as usage, and cumulative transaction volume is not revenue. Even if transaction volume grows, it is still necessary to distinguish between total fees paid by users, the shares received by participants, and the revenue that may ultimately remain in the ecosystem.

That is why the report of a $3.8 million vulnerability matters for more than its dollar amount. For a product marketed on simplifying cross-chain operations, users also need to know where the issue occurred, which operations were affected, whether any components still in use were involved, how the fix was verified, and whether any unresolved losses or liabilities remain after the funds were returned. The available information does not answer these questions, nor does it establish whether the vulnerability was connected to the Sunrise integration. The two issues are discussed in the same article because they both affect how the market assesses the ability to expand—not to imply a causal link between them.

Likewise, the fact that a new perpetual futures market listed NEAR as a supported asset means there is now another way to trade it, but does not prove that demand to use the NEAR network has increased. Derivatives can make trading more convenient and attract short-term attention; whether that translates into ecosystem activity is a separate question.

Diverging views on capital: new demand or a rebound after short covering

Those taking a more positive view put the product integrations, claims of related fund inflows, and the price rebound together: if an improved cross-chain experience brings in real users and capital continues to flow in, the rally need not rely solely on short-term position changes. This view has a clear path to verification, but for now there is no continuous dataset that has been independently checked.

Those urging caution note that NEAR had already risen substantially and had also experienced a pullback. A sharp rebound over a short period may partly reflect a recovery from that decline. If the liquidation figures cited above are accurate, roughly $3.70 million in short liquidations accounted for nearly seven-tenths of the approximately $5.47 million total—enough to suggest that short covering may have helped drive the move, but not enough to calculate its specific contribution to the token’s price. Nor can one claim that there was insufficient new buying without records of spot-market flows and changes in open positions.

The same logic applies to funds. If inflows are confirmed by official data, they would support the claim that new demand exists. But a single day of inflows cannot establish a trend, much less be directly attributed to increased use of NEAR Intents. Claims in market reports about cumulative inflows, staking arrangements, and product revenue all still need to be checked separately against their respective methodologies; they cannot be combined into a single fundamental gain that has already materialized.

What facts could change the assessment next

First, formal information about the security incident: disclosure of the vulnerability, the scope of its impact, verifiable records of funds returned, remediation measures, and subsequent reviews. Without such information, if it is not provided promptly, “the funds have been returned” can only be treated as an inadequately verified development, not proof that security concerns have been resolved.

Second, evidence of usage following the integration. Whether Sunrise-related features are actually live and which operations they cover, as well as whether sustained trading, real users, and fee retention can be observed, would say more about product progress than the word “integration.” If the list of new markets or networks grows but sustained usage remains absent, the case that product expansion is improving fundamentals will weaken.

Finally, the structure of capital flows: whether related funds show confirmed net inflows on a continuing basis; and whether, after price volatility, spot trading, open interest, and liquidations point to sustainable new demand rather than one-off short covering. If subsequent data show only that the squeeze has ended and trading has cooled, while ecosystem usage has not picked up, there will be little support for interpreting the rebound as a fundamental revaluation. Conversely, a clear explanation of the security issue, sustained growth in product usage, and corroborating, verifiable capital-flow data would weaken the argument that this is merely a short-term recovery.

NEAR is not facing a single positive or negative catalyst right now, but rather a set of facts that need to be verified separately: whether the product is genuinely being used, whether the vulnerability has been properly addressed, and whether capital entering the market is sustained. Until those questions are answered, the price gain can indicate heightened interest, but it cannot replace verification.