# NEAR Intents Says It Has Identified Its Attacker and Gives 48 Hours to Return $3.8 Million

The bug sat in the handoff between the Omni deposit system and the Intents contract, two components that each worked correctly on their own.

- Published: 2026-10-02T06:09:12.150Z
- Canonical: https://polylog.news/crypto/2026-10-02/near-intents-says-it-has-identified-its-attacker-and-gives-4
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [CoinDesk](https://www.coindesk.com/tech/2026/10/01/near-intents-hit-by-usd3-8-million-exploit-as-crypto-s-rough-year-of-hacks-continues), [Polylog editors](https://polylog.news), [Crypto Briefing](https://cryptobriefing.com/near-intents-attacker-48-hours-return-funds/)

NEAR Intents, the cross-chain trading system built around solver-fulfilled user intents, says it has [identified the person behind the $3.8 million exploit it suffered on 1 October and has given them 48 hours to return the funds](https://t.me/cointelegraph/72446). The team had already said the [vulnerability was patched, that users will be compensated in full and that service would resume within the hour](https://t.me/BWEnews/16504).

The root cause was not a single broken contract. CoinDesk reported that the loss followed [a bug in how the Omni deposit and withdrawal system interacted with the NEAR Intents smart contract](https://www.coindesk.com/tech/2026/10/01/near-intents-hit-by-usd3-8-million-exploit-as-crypto-s-rough-year-of-hacks-continues), affecting deposits and withdrawals across several networks and forcing a pause. The failure landed in the seam between two components that behaved correctly in isolation. Blockchain investigator ZachXBT traced the first irregular withdrawals to a BNB Chain hot wallet linked to NEAR Intents, with funds routed to KuCoin and swapped into bitcoin.

The 48-hour ultimatum is a negotiating posture rather than an enforcement tool. Crypto Briefing reported the deadline came from the system's [general manager](https://cryptobriefing.com/near-intents-attacker-48-hours-return-funds/), and teams that issue such deadlines are usually signalling that they hold off-chain identifying information and would prefer a quiet return to a referral. The intermediate outcome, which several 2026 incidents have produced, is a negotiated bounty.

The incident also shows what intent-based routing actually custodies. Users experience a single swap, while behind it sit hot wallets and solver balances on multiple chains. Those balances are the attack surface, and they are not reduced by removing a classic lock-and-mint bridge from the design.

## What this means

The exposed parties are users of intent-based and solver-routed cross-chain systems, and the channel is operational custody: the funds at risk were hot-wallet and solver balances, not pooled bridge collateral, so the loss stayed in the single-digit millions rather than nine figures. NEAR Intents wants to close the story with full reimbursement and a voluntary return, and it can afford the smaller sum, which is why the ultimatum came with a patch and a compensation pledge rather than law enforcement language. The documented precedent is the pattern across 2025 and 2026 incidents in which identified attackers returned a majority of funds in exchange for a bounty and no referral. The likelier outcome within weeks is either a partial negotiated return or complete silence followed by exchange-level freeze requests, with the deciding factor being how much off-chain identifying data the team actually holds. Expect interface-layer and component-seam audits to become a stated requirement for intent systems over the next few months, which would prove out if competing routers publish such reviews.

## What to watch

- Whether any funds return within the stated deadline, which would tell the market whether these public ultimatums carry real leverage.
- Whether NEAR Intents publishes a full post-mortem naming the interface mismatch, the only way other solver networks can check for the same defect.
- Whether exchanges that received the swapped proceeds confirm freezes, the test of whether attribution converts into recovery.