CandyPulse

$3.8 Million Lost. What Happens Next? Inside the NEAR Intents Recovery

By · 2026-10-02 · Blog

Every crypto exploit has two stories. The first is the one that makes headlines: money gone, a bug found, prices falling. The second is quieter and, for users, far more important: what happens next?

NEAR Intents is living through that second story right now. After an exploit drained about $3.8 million, the cross-chain swap protocol paused, patched the flaw, restarted its services and made a bold promise: full compensation for everyone affected.

So what does a recovery like this actually involve, and what should users watch for?

Key takeaways

First, what is NEAR Intents?

NEAR Intents lets people swap crypto across different blockchains by simply stating what they want, their "intent", such as "swap my USDC on Polygon for ETH on Arbitrum". Behind the scenes, the system works out how to make it happen.

That convenience is the whole point. But moving value between chains means more moving parts, and every moving part is a place where something can break.

What went wrong

According to the team, the problem sat between two systems: NEAR's Omni infrastructure, which handles deposits and withdrawals, and the NEAR Intents smart contract. A bug in how they interacted gave an attacker a way to pull out about $3.8 million.

It's a pattern seen again and again in crypto. Individual pieces of code can each look fine on their own, but the connections between them create gaps nobody anticipated.

The four stages of a crypto recovery

Stage 1: Stop the bleeding

The first job in any exploit is to halt activity so the damage can't spread. NEAR Intents paused its services while the team investigated. It's a frustrating moment for users, but a necessary one.

Stage 2: Fix the flaw

Next comes the patch. The team fixed the contract vulnerability and restarted NEAR Intents and Near.com soon afterwards. Not everything came back instantly: deposits and withdrawals on 11 chains, including BSC, Polygon and Optimism, stayed unavailable for roughly 12 hours while systems were checked.

Stage 3: Trace the money

Blockchains are public, which makes stolen funds traceable. The stolen crypto was reportedly sent to the KuCoin exchange and bridged to bitcoin. NEAR Intents says it's working with law enforcement and blockchain analytics firms to follow it.

Tracing doesn't guarantee recovery, but when stolen funds touch a regulated exchange, there's a real chance they can be frozen.

Stage 4: Make users whole

This is the stage that defines a project's reputation. NEAR Intents has promised full compensation. The questions that matter now are practical:

A promise is a strong start. The post-mortem report the team plans to publish should answer many of these questions.

Recovery at a glance

StageWhat NEAR Intents didStatus
StopPaused servicesDone
FixPatched the contract vulnerabilityDone
RestartReopened NEAR Intents and Near.comDone, with some chain limits
TraceWorking with law enforcement and analytics firmsOngoing
RepayPledged full compensationDetails pending

How the market reacted

The NEAR token reportedly fell about 9% as the news broke. That's typical. Markets punish uncertainty first and ask questions later. How quickly confidence returns will depend largely on how smoothly compensation is handled.

Why fast, honest responses matter

Crypto has seen both kinds of responses to hacks: teams that go silent, and teams that act fast and communicate openly. The difference in outcomes is huge.

Projects that pause quickly, explain clearly and compensate fairly often come out with more trust than before, because users have seen how they behave under pressure. Projects that hide or delay rarely recover.

So far, NEAR Intents is following the playbook of the first group.

What users should do right now

  1. Follow official channels only. Updates on compensation will come from NEAR Intents' verified accounts and website.
  2. Ignore "recovery helpers". Scammers often contact victims offering to help claim refunds for a fee. Legitimate compensation never requires you to pay or share your seed phrase.
  3. Check chain status before moving funds, especially on the networks that were temporarily limited.
  4. Read the post-mortem. It will explain what happened and what's changed.

The bigger lesson

Cross-chain tools are among the most useful things in crypto, and among the most targeted. Bridges and swap systems have suffered some of the industry's largest losses, because they sit where value moves between worlds.

None of that means avoiding them. It means using them thoughtfully: not keeping more funds in transit than you need, sticking to well-established tools, and paying attention to how projects handle problems when they happen.

The bottom line

$3.8 million is a painful loss. But the story of NEAR Intents isn't finished. It has stopped the damage, fixed the bug, restarted and promised to make users whole. If it delivers on that promise, this could become an example of how to handle a crisis well.

For now, the most important word in the story is the one on the banner: next.

This article is for information only and is not financial advice.

More on CandyPulse

You Set the Goal, Agents Do the Work: Why AI Agent Payments Will Shape the Next Internet, and How CANDY Is Building x402 On Chain

Press Play on Possibility: A Player's Guide to the CANDY Presale

Your World, More Connected: How the CANDY Ecosystem Links Payments, Games, AI and Community

CandyWorld Is Coming: Rush Swapping, a New World in Your Pocket

Trending now

More Than a Whitepaper: 4 CANDY Products You Can Use Today

Bitcoin Meets Banking: Jeonbuk Bank Launches South Korea's First Won Loan Backed by Bitcoin

More Bitcoin for Strategy? Saylor Hints at a Purchase With a Sunday Chart, but Confirmation Is Pending

Sweet Name, Big Possibilities: Why the CANDY Presale Is Different

Ledger Confirms Hidden Implant in Reseller-Sold Wallet as CryptoBilis Halts Sales During Probe

CANDY Weekly: The Week in Crypto and the CANDY Ecosystem (Oct 12–18, 2026)