🚨 Suspicious activity involving @near_intents: ~$4M in withdrawals
Our monitoring has flagged a series of suspicious withdrawals totaling approximately $4M
At this stage, it is not clear whether this is an exploit of the protocol or whether the funds may be connected to cious txs:
0x9fe58e031f73bbd880c782bc9e7446bcda32cadb304a729209871a4a81856c4c
0x0381265d6a1bb09de899f49f410a8b907cd548358a7e3c91076c3a52656b8220
0x69d1c68c7e961a0199d3c9f3b6a31cb168ed775ef34b51a42762253ac1efcceb
0x9c10b967da0c85631ec105e3b322c0a851fcd01b69ff390ff58f860e5cce003a
Our tracing indicates that funds are currently moving toward @kucoincom, with some funds bridged to BTC
We are actively monitoring the situation and will share updates as they become available, pending official confirmation of security incident from NEAR Intents
Our monitoring has flagged a series of suspicious withdrawals totaling approximately $4M
At this stage, it is not clear whether this is an exploit of the protocol or whether the funds may be connected to cious txs:
0x9fe58e031f73bbd880c782bc9e7446bcda32cadb304a729209871a4a81856c4c
0x0381265d6a1bb09de899f49f410a8b907cd548358a7e3c91076c3a52656b8220
0x69d1c68c7e961a0199d3c9f3b6a31cb168ed775ef34b51a42762253ac1efcceb
0x9c10b967da0c85631ec105e3b322c0a851fcd01b69ff390ff58f860e5cce003a
Our tracing indicates that funds are currently moving toward @kucoincom, with some funds bridged to BTC
We are actively monitoring the situation and will share updates as they become available, pending official confirmation of security incident from NEAR Intents
Oct 1, 2026 · 1:15 PM UTC
4
4
41
4,613
Earlier today NEAR Intents services were stopped after a security incident was detected. The incident was caused by a bug in the Omni deposit and withdrawal infrastructure interaction with NEAR Intents smart contract.
The preliminary report indicates the total loss of approximately $3.8M. These funds will be compensated in full.
The contract-side vulnerability has been patched. The operations of the NEAR Intents and near(.)com are expected to resume within 1h.
Deposits and withdrawals on the following networks will remain unavailable for an additional ~12 hours while fixes to the Omni infrastructure are completed: BSC, Polygon, TON, Optimism, Avalanche, Stellar, Monad, LayerX, Adi, Scroll and Plasma.
In case users hold any assets from these chains inside NEAR Intents (for example, in HOT wallet or on near(.)com), they will be able to swap them into other assets once NEAR Intents is back up (in ~1h).
The incident has been reported to law enforcement, and we are working with security and blockchain analytics partners to trace the funds and pursue recovery. A detailed report will be shared publicly in the following days.
0
1
4
723
@AMLBotHQ @near_intents “Not clear whether exploit or connected to” is doing a lot of work there. Do you have the outflow addresses? Can't diff against my own ruleset without them.
0
0
0
4
@AMLBotHQ @near_intents Which address cluster? "Suspicious withdrawals" without a source address is hard to screen against. If you can share the BSC hot wallet outflow txs I can run them against our ruleset.
0
0
0
9