CandyPulse

$3.8 Million Lost. What Happens Next? Inside the NEAR Intents Recovery

By CANDY News Desk · 2026-10-02 · Blog

Every crypto exploit has two stories. The first is the one that makes headlines: money gone, a bug found, prices falling. The second is quieter and, for users, far more important: what happens next?

NEAR Intents is living through that second story right now. After an exploit drained about $3.8 million, the cross-chain swap protocol paused, patched the flaw, restarted its services and made a bold promise: full compensation for everyone affected.

So what does a recovery like this actually involve, and what should users watch for?

Key takeaways

First, what is NEAR Intents?

NEAR Intents lets people swap crypto across different blockchains by simply stating what they want, their "intent", such as "swap my USDC on Polygon for ETH on Arbitrum". Behind the scenes, the system works out how to make it happen.

That convenience is the whole point. But moving value between chains means more moving parts, and every moving part is a place where something can break.

What went wrong

According to the team, the problem sat between two systems: NEAR's Omni infrastructure, which handles deposits and withdrawals, and the NEAR Intents smart contract. A bug in how they interacted gave an attacker a way to pull out about $3.8 million.

It's a pattern seen again and again in crypto. Individual pieces of code can each look fine on their own, but the connections between them create gaps nobody anticipated.

The four stages of a crypto recovery

Stage 1: Stop the bleeding

The first job in any exploit is to halt activity so the damage can't spread. NEAR Intents paused its services while the team investigated. It's a frustrating moment for users, but a necessary one.

Stage 2: Fix the flaw

Next comes the patch. The team fixed the contract vulnerability and restarted NEAR Intents and Near.com soon afterwards. Not everything came back instantly: deposits and withdrawals on 11 chains, including BSC, Polygon and Optimism, stayed unavailable for roughly 12 hours while systems were checked.

Stage 3: Trace the money

Blockchains are public, which makes stolen funds traceable. The stolen crypto was reportedly sent to the KuCoin exchange and bridged to bitcoin. NEAR Intents says it's working with law enforcement and blockchain analytics firms to follow it.

Tracing doesn't guarantee recovery, but when stolen funds touch a regulated exchange, there's a real chance they can be frozen.

Stage 4: Make users whole

This is the stage that defines a project's reputation. NEAR Intents has promised full compensation. The questions that matter now are practical:

A promise is a strong start. The post-mortem report the team plans to publish should answer many of these questions.

Recovery at a glance

StageWhat NEAR Intents didStatus
StopPaused servicesDone
FixPatched the contract vulnerabilityDone
RestartReopened NEAR Intents and Near.comDone, with some chain limits
TraceWorking with law enforcement and analytics firmsOngoing
RepayPledged full compensationDetails pending

How the market reacted

The NEAR token reportedly fell about 9% as the news broke. That's typical. Markets punish uncertainty first and ask questions later. How quickly confidence returns will depend largely on how smoothly compensation is handled.

Why fast, honest responses matter

Crypto has seen both kinds of responses to hacks: teams that go silent, and teams that act fast and communicate openly. The difference in outcomes is huge.

Projects that pause quickly, explain clearly and compensate fairly often come out with more trust than before, because users have seen how they behave under pressure. Projects that hide or delay rarely recover.

So far, NEAR Intents is following the playbook of the first group.

What users should do right now

  1. Follow official channels only. Updates on compensation will come from NEAR Intents' verified accounts and website.
  2. Ignore "recovery helpers". Scammers often contact victims offering to help claim refunds for a fee. Legitimate compensation never requires you to pay or share your seed phrase.
  3. Check chain status before moving funds, especially on the networks that were temporarily limited.
  4. Read the post-mortem. It will explain what happened and what's changed.

The bigger lesson

Cross-chain tools are among the most useful things in crypto, and among the most targeted. Bridges and swap systems have suffered some of the industry's largest losses, because they sit where value moves between worlds.

None of that means avoiding them. It means using them thoughtfully: not keeping more funds in transit than you need, sticking to well-established tools, and paying attention to how projects handle problems when they happen.

The bottom line

$3.8 million is a painful loss. But the story of NEAR Intents isn't finished. It has stopped the damage, fixed the bug, restarted and promised to make users whole. If it delivers on that promise, this could become an example of how to handle a crisis well.

For now, the most important word in the story is the one on the banner: next.

This article is for information only and is not financial advice.

More on CandyPulse

AI Knows Your Prompts. Does It Need Your Identity? Ethereum's zkAPI Explained

Uptober Is Here. Can Bitcoin Hold $86K?

Who Holds the Keys? Inside the SEC's Crypto Custody Proposal

A Stock. A Token. What Do You Actually Own? Robinhood and the Ownership Question