NEAR Intentions suspends withdrawal after encountering a $3.8 million vulnerability attack: Analysis

NEAR Intentions confirmed to have suffered a vulnerability attack of more than US$3.8 million: Close the vulnerability and suspend deposits and withdrawals from the eleven major networks

On October 1, 2026, NEAR Intentions confirmed to have suffered a security vulnerability attack involving more than US$3.8 million. The project party immediately closed the relevant loopholes and suspended deposit and withdrawal services on eleven networks. At present, the project party has promised to fully compensate all affected funds, but has not yet announced a specific compensation schedule.

If you have ever used this exchange layer to transfer balances between two blockchains, there is only one most critical decision factor at the moment: Where your balance is currently located and whether it must stay there.

Market performance and infrastructure impact

As of the afternoon of October 1, 2026, the price of NEAR was US$4.90, down 6.96% from the previous day; but in the past week, its value has increased by 7.66%. However, price fluctuations are only superficial, and the more core problem lies in the interruption of infrastructure. According to operators, more than $30 billion in funds had flowed through the layer on 35 networks, while the infrastructure was only partially available within hours.

What happened to NEAR Intention on October 1?

NEAR Intention is the cross-chain switching layer in the NEAR protocol ecosystem. This layer receives a user's "intent"(such as exchanging one token from one blockchain for a token on another) and allows service providers to compete to execute these instructions. On Thursday, unusual withdrawals flowed out of a hot wallet on the floor. According to the project party, the damage caused exceeded US$3.8 million.

The team publicly admitted the incident, closed the affected links in the smart contract, and suspended deposit and withdrawal operations on multiple connected networks. It is said that core business will resume soon, but the restoration of deposit and withdrawal functions will take longer. This time difference is crucial to you: A service that allows redemption but not withdrawals is not available to you.

What is a "hot wallet"?

Hot wallets are wallets with private keys stored on systems connected to the Internet, which allows the platform to automatically perform payments. This online access feature is both why it is fast and why it is a preferred target for attacks. The contrast is a cold wallet, whose private key remains offline.

Root cause of the failure: Interaction flaw between Omni Bridge and Intents Contract

The project party described the cause as a failure in the Omni deposit and withdrawal system when interacting with the NEAR Intention smart contract. It is not that a single component is defective, but that there is a problem in the handover between the two components. This is common in cross-chain infrastructure attacks, which explains why audit reports for individual contracts often provide only limited information: what is audited is usually the underlying modules, and what is exploited is often the joint interfaces between modules.

In this architecture, Omni is the level that accepts deposits from external blockchains and releases withdrawals to them. The Intentions level above it determines where the balance goes. Anyone who can get the two levels out of sync can trigger a withdrawal that is not backed by a valid deposit. According to the team, the vulnerability on the contract side has been fixed.

The patch has been applied, but the alert has not been lifted

Closing contract vulnerabilities can prevent similar attacks from happening again, but this does not mean that the same federation interfaces elsewhere are still open and funds that have already flowed out cannot be recovered. Therefore, what matters to you is not the notification about the patch, but when the withdrawal function on the network where your balance is located will reopen.

Eleven affected networks

Networks reported to be affected by the suspension include BNB Smart Chain, Polygon, TON, Optimism, Avalanche, Stellar, Monad, X Layer, ADI, Scroll and Plasma. This list reflects the actual situation of the day. A flawed junction point can simultaneously cut off access to eleven different ecosystems, which also shows how many chains rely on this shared layer.

In practice, this means that an ongoing exchange may stall if its equivalent asset should reach one of the above-mentioned networks. If balances already exist on these chains and are stored in your own wallet rather than the exchange layer, they will not be automatically affected. The difference between "in my wallet" and "in service transit" determines the extent of loss in such incidents.

Tracking path: How ZachXBT traced US$3.8 million to Bitcoin

ZachXBT, an investigator focusing on chain trace analysis, traced the flow of funds: The abnormal outflow started with a hot wallet on the BNB Chain attributed to NEAR Intention. Subsequently, the funds flowed to the KuCoin exchange and were converted into Bitcoin. This path is typical because Bitcoin has the deepest liquidity and the tracking chain breaks once an account enters the exchange.

The project party said it had reported the matter to law enforcement and hired security and analysis companies to further track the funds. Whether to freeze the amounts received is its own decision and is usually implemented only after receiving a formal request. As of now, there are no reliable statements about money recovery, and no one should make a promise to you.

Full compensation commitment, date to be determined: Fate of balance during the gap period

The team promised to fully compensate the affected funds, but did not specify a timetable. This combination is the most delicate part of the incident because it creates a claim that cannot be quantified or scheduled: your claim is against a project, not a regulated body with deposit protection.

In practice, this means three things:

1. Your switch-layer balance will not be available until it is released.
2. The promise of full compensation without a specific date is only a statement of intention, not a debt due.
3. If you have no evidence of the status of the balance before the accident, you are responsible for proving your own claim. At this moment, a screenshot with the date and the ID of the last exchange transaction is more valuable than any market analysis.

People holding long-term positions should take this opportunity to transfer assets where there are no third-party services between you and the private key. For which devices and programs work for this and the differences between them, see the Hardware Wallet Comparison Guide. The switch layer is a channel, not a warehouse.

Cross-chain swaps, intentions, and solvers: How the exchange layer works

Intent is a statement of intent: You set what you want to give up and what you want to gain, and leave the route to others. Solver (solver)Is the service provider that implements this intention and earns the price difference. In contrast, the classic bridging mechanism is to lock your token on one chain and issue its representative certificate on another chain.

This distinction is crucial for risk issues. For bridging, the risk lies in supporting locked positions on behalf of certificates; for the Intent system, the risk lies in the operation of the deposit and withdrawal layer and the solver, which temporarily has someone else's balance at its disposal. This is the level affected on October 1. For you, the key is not whether a certain method is safe, but how long your balance stays in the hands of third parties.

Length of time the balance is in transit

• Exchanges completed in seconds leave you briefly exposed to the risk of failure.
• Exchanges in which equivalent assets take minutes or hours to arrive expose you to long-term risks.
• The practice of leaving the balance in the service after the exchange exposes you to permanent risk. The third method is the most costly but also the most common because of its convenience.

The $50 million interception a week ago and the current $3.8 million loss

The same platform was on the other side of the incident last week: At the time, the service intercepted approximately $50 million from a Bitget hack before the funds were transferred. Seven days later,$3.8 million was lost to the same infrastructure.

This is not a reason to gloat, but a clear understanding. Platforms that can block other people's funds have deep insight into the payment process and accordingly have many touchpoints. The kind of influence that makes interception possible also creates an attack surface. Focusing only on service capabilities and ignoring the number of transition points is underpricing risk.

Current self-inspection list: Your cross-chain position status

The following four points are crucial and each point can only take a few minutes to complete:

1. Open Exchanges: Check your history for exchanges that have not been completed after September 30 and have no matching records. Write down the time, network and transaction ID.
2. Remaining balance in the service: The balance left in the layer after the exchange should be transferred to your own wallet immediately after the withdrawal function is restored.
3. Wallet Authorization: Withdraws the unlimited authority you once granted to the contract. Even if you have long stopped using the service, old licenses may still take effect.
4. Network where the balance is located: If the balance is located on one of the eleven suspended networks, wait for release and do not attempt to bypass it through a second unfamiliar service.

The key is to distinguish between "waiting" and "doing nothing." Waiting means observing the situation, preserving evidence, and not investing new funds in the affected sectors. Doing nothing means leaving the balance there, making it impossible to prove the exact amount later.

MiCA, Custody and Holding Period: Vulnerability Response under the German Legal Framework

Starting from January 1, 2026, only authorized providers can provide crypto asset services in Germany; the transition period within the EU will expire no later than July 1, 2026. The decentralized exchange layer is not a regulated custodian, which is the key to the legal consequences: There is no deposit insurance, there is no basis for complaining about service obligations to BaFin (the German Federal Financial Supervisory Authority), and there is no entity to enforce compensation.

Anyone who wants to draw clear boundaries in daily use should buy and sell through an authorized provider and use cross-links only for the purpose for which they were designed. An overview of authorized providers in Europe can be found in information on regulated cryptocurrency exchanges. This is not a substitute for your own judgment, but it can include part of the assets entrusted to third parties in a framework with obligations.

Impact of compensation on holding period

The one-year holding period in German income tax law applies to the acquisition and disposal of the same asset. Whether compensation is considered a reversal or a new gain for tax purposes depends on how it is performed technically: whether it returns the same token or is returned at an equivalent value in another currency. You should document this difference before compensation occurs, not afterwards.

NEAR's reaction to vulnerability: Price fell to $4.90, down 6.96%

2026 年 10 月 1 日下午，NEAR 价格为 4.90 美元，当日高点为 5.52 美元，低点为 4.79 美元。与前一日相比下跌 6.96%，使 NEAR 成为当天 25 大加密货币中表现最弱的币种；市值约为 64 亿美元，日交易量约 14 亿美元。不过，过去七天内仍有 7.66% 的收益。数据来源于 CoinGecko。

这些数字描述的是一种反应，而非估值。在 380 万美元的损失下，近 7% 的跌幅表明市场认为损失金额本身较小，而交换层的中断才是更昂贵的部分。后续走势取决于所有十一个网络上的存取款功能恢复的速度。

背景：一个月内的巨额损失

此次事件并非孤立存在。2026 年 9 月 30 日的统计显示，加密黑客攻击在一个月内造成了 7.66 亿美元的损失。在此背景下，380 万美元虽属小额，但其教训更为重要：不仅是大额资金受损，即使是未知的项目也会受到冲击。

黑客事件后的税务处理：如何记录损失与赔偿

在德国报税中，有据可查的内容才具效力。请尽早而非稍后保存以下内容：事故前的持仓及其日期、受影响操作的交易 ID、项目方公开声明及其日期，以及此后每一笔贷记的金额和时间。无法证实的损失在税务上无效，而无法解释来源的赔偿则会引发疑问。

Whether the losses caused by theft are fully deductible has not yet been finalized in Germany and depends on the circumstances of the case; only a tax consultant or the tax authority can give a binding answer. The first step is indisputable: complete and timely documentation. Regarding the interaction of the basic rules on holding periods, tax exemptions and reporting obligations, see our overview of German cryptocurrency taxation.

Lessons learned from the NEAR Intent vulnerability

• Immediate preservation of evidence: Pre-accident position, transaction ID, date declared by the project party. For continued position bookkeeping, tax tools and related tools in the Portfolio Tracker can be used.
• Move long-term positions out of the channel: Assets planned to be held for the long term should not be placed in the exchange layer. Please refer to the Software Wallet Comparison Guide to learn how to self-host on your phone or computer.
• Separating purchase routes from exchange routes: Regular purchases are made through authorized providers, and cross-chain routing is used for specific purposes only.