Attacker drains $3.8 million from Near Intents via bug in Omni deposit and withdrawal layer

Near Intents fills orders by having rival market makers compete to quote prices ^[13]. The attacker went in at the edge of the system, where deposits arrive and withdrawals leave. "The incident was caused by a bug in the Omni deposit and withdrawal infrastructure interaction with NEAR Intents smart contract," the team posted on X ^[2]. Decrypt, reporting the drain, wrote that "Moving value between blockchains means pooling money in the middle, and pools attract thieves" ^[15]. Its reference case is the 2022 Harmony bridge hack, at about $100 million ^[16].

By size this one is small. Near Intents says it has handled more than $30 billion of swaps across 35 blockchains ^[13], so the $3.8 million taken ^[1] is at most about 0.013% of lifetime volume, a little over one basis point ^[20]. Harmony lost roughly 26 times as much ^[18]. Decrypt gave two readings for the NEAR token, a 6.7% fall to $4.96 ^[11] and an 8.93% fall to $4.86 ^[12]. Both imply a starting price near $5.33 ^[21], so they look like two snapshots of the same slide. Even at the lower figure the token sits about 86% above the $2.61 it traded at when Bitwise filed for its ETF in April 2025 ^{[14] [19]}.

Three outcomes are open. The promised report ^[6] could show a narrow integration error, with affected users repaid in full within days, in which case the pledge was as good as cash. Repayment could instead come slowly or only in part, leaving those users as unsecured creditors of the operator. Or the drain could turn out to be linked to the Bitget hacker Near Intents turned away two days earlier, though Decrypt reported that no link is clear ^[8] and the North Korea attribution from Bitget CEO Gracy Chen and Elliptic is unconfirmed ^[10].

In my view users should assume the second case until the report arrives, though a contract fix already in place ^[5] is a point for the first. Near Intents has not disclosed whose funds were taken ^[17] or what will pay for its pledge that the losses "will be compensated in full" ^[3]. A repayment promise with no named source of money is a claim on the same operator whose contracts lost it. The view is wrong if the report names the affected accounts and shows them paid in full, from reserves Near Intents can identify, within days of publication.