NEAR Intents Suffers $3.8M Exploit, Yet Prompt Recovery Sparks Debate Over a ‘Bullish Hack’

The decentralized finance landscape experienced another security test this week as NEAR Intents, a major cross-chain privacy swapping protocol, was temporarily forced offline following a security breach that resulted in the loss of approximately $3.8 million. The incident, which unfolded on Thursday, highlights the persistent vulnerabilities facing cross-chain liquidity layers and smart contract communication interfaces within the broader Web3 ecosystem. Despite the financial loss, the protocol’s rapid containment, transparent public communication, and commitment to total user reimbursement have drawn unexpected praise from market observers, with some even labeling the event a "bullish hack."

According to details shared in the wake of the incident, the security flaw resided specifically within the bridging and transfer layer—the delicate architecture responsible for moving capital in and out of the protocol—and how this layer communicated with the primary smart contracts holding user funds. Promptly identifying the anomaly, prominent blockchain sleuth ZachXBT tracked the movement of the stolen funds to centralized exchange KuCoin, where the attacker attempted to convert the pilfered assets into Bitcoin. In response to the breach, the NEAR Intents core team immediately escalated the matter to law enforcement authorities and promised a comprehensive post-mortem report detailing the exact vector of the exploit.

To fully understand the gravity of the disruption, it is important to contextualize the role NEAR Intents plays in the current multichain era. Designed to facilitate seamless cryptocurrency swaps across disparate blockchains while offering privacy-preserving features, the protocol has established itself as a major beneficiary of the recent privacy narrative in decentralized finance. Prior to the exploit, NEAR Intents had successfully processed an astounding volume of over $30 billion in cumulative swaps distributed across 35 distinct blockchain networks, cementing its status as an integral piece of infrastructure for cross-chain liquidity.

The operational response to Thursday’s breach was executed with remarkable speed. The specific contract-side vulnerability was identified and patched, allowing core operational services to be brought back online within roughly an hour of the initial detection. However, out of an abundance of caution, inbound and outbound deposits and withdrawals across 11 major supported networks—including high-volume ecosystems like BNB Chain, Polygon, and Optimism—remained temporarily suspended for an additional 12 hours while engineers deployed the remainder of the security patches and verified network integrity. Crucially, the development team announced that every single user affected by the exploit would be fully compensated, neutralizing out-of-pocket losses for retail participants.

The immediate financial impact of the hack was felt across public markets and associated investment vehicles. The native NEAR token experienced a downward correction, falling nearly 9% to trade at $4.86. Concurrently, shares of the newly launched Bitwise NEAR ETF dropped by more than 7%. The timing of the security incident was particularly striking given that the Bitwise ETF had officially debuted just two days prior. Consequently, the fund’s inaugural week of public trading was instantly overshadowed by a high-profile security event involving the exact network infrastructure that asset managers had cited as fundamental proof of the ecosystem’s burgeoning organic growth and technological adoption.

Nevertheless, when evaluated against the historical spectrum of decentralized finance exploits, industry analysts have pointed out that Thursday’s event represents a best-case scenario for managing a severe crisis. The contrast with previous major industry hacks is stark. For instance, Kelp DAO previously suffered an exploit resulting in the loss of hundreds of millions of dollars; Bitget faced a staggering $387.5 million loss alongside a four-day freeze on user withdrawals; and MetaMask was forced to pull certain validators offline while providing minimal public communication to its user base.

By comparison, the playbook executed by NEAR Intents stands out for its transparency and efficiency. The team quickly identified the bug, halted the vulnerable service, deployed a patch, successfully restarted core operations within an hour, publicly disclosed the nature of the problem, engaged law enforcement, and committed immediately to making users whole. This coordinated crisis management minimized overall damage and contained the systemic fallout.

This measured and responsible handling of a crisis has ignited a broader debate within crypto circles, with some market participants going so far as to characterize the incident as a "bullish hack." Proponents of this view liken the event to historical precedents such as the foundational ZCash exploit, which was initially discovered and responsibly managed by its own internal team. As the dust settles around the NEAR Intents breach, the ultimate question remains whether this rapid and transparent remediation will ultimately bolster investor confidence or cast a lingering shadow over the network’s broader adoption curve.