Near Intents Hacked for $3.8M Days After Denying North Korea-Linked Bitget Hacker

Near Intents stopped cross-chain swap operations on Thursday after detecting a security breach that allowed an attacker to drain roughly $3.8 million. The team traced the problem to a flaw in the Omni layer that handles deposits and withdrawals and communicates with the protocol's primary smart contract, the company said on X. It reported the incident to law enforcement and engaged blockchain-forensics partners to follow the stolen funds. On-chain investigator ZachXBT reported that the stolen assets moved through KuCoin and were eventually bridged into bitcoin. Near Intents said it has fixed the contract-side vulnerability and expects core services to resume within about an hour, while deposits and withdrawals across 11 connected networks will remain suspended for around 12 more hours as Omni-layer fixes are completed. The project promised to reimburse all users whose funds were taken and said a detailed postmortem will be published in the coming days. The exploit came two days after Near Intents blocked a $50 million swap attempt tied to the Bitget hacker, an attacker who reportedly stole about $387.5 million from the exchange the prior week. Bitget's CEO and analytics firm Elliptic have pointed to North Korea as the likely actor behind that hack, though attribution has not been definitively confirmed and Near Intents said it is not yet clear whether the incidents are linked. The timing is notable for NEAR ecosystem participants: Bitwise launched a NEAR token exchange-traded fund two days before the theft, and the NEAR token saw a sharp price drop following the incident. Near Intents handles liquidity between chains and has facilitated over $30 billion in swaps across 35 blockchains since launch, underscoring how middle-layer infrastructure can become a concentration point for assets and an attractive target for attackers.