Original author: Jiminy, Deep Wave TechFlow
On October 1, following the announcement of a sudden security incident, $NEAR, which had just experienced a strong rise, plunged sharply in the short term, and the drop once reached 8%.
Many players who are not keeping track of the market may still be confused: What happened to NEAR? Has the mainnet been hacked?
Let me briefly explain the unexpected incident: NEAR Intents, the core cross-chain protocol in the NEAR ecosystem, suffered a hacker attack today, and approximately US$3.8 million in assets were taken away from the underlying treasury.
But if you connect the timeline of the past 48 hours, you will find that this incident staged a dramatic reversal with great black humor.
Just a few days ago, the Bitget exchange suffered a hacker attack, and the attackers attempted to launder more than $50 million in stolen funds through NEAR Intents. As a result, SHIELD, the protocol’s AI security monitoring layer, saw through it on the spot and froze the huge sum of money. Among them, about 503,000 US dollars were successfully frozen during the execution process, and only about 166,000 US dollars passed through by chance. Most of the remaining attempted transfers were rejected.
For a time, the community praised NEAR Intents as the "pioneer of full-chain defense". However, the halo has not yet worn off. Today, hackers directly exploited the contract logic loopholes in the underlying deposit and withdrawal interfaces to steal assets from their own vaults.
Just as he held down a 50 million-level thief at the door, someone else pried open the back door of his own vault.
Putting aside this layer of drama, for secondary market traders and $NEAR holders, we need to strip away emotions and see clearly the true asset boundaries and subsequent deductions of this incident.
The problem is not the mainnet, the problem is Near Intents
According to NEAR founder Illia's disclosure, what is affected this time is NEAR Intents, a cross-chain intent protocol built on NEAR, rather than the NEAR L1 mainnet consensus layer. The security of the core protocol and native tokens has not been compromised.
The entry point of the attack is extremely precise.
The hackers did not attack the core logic of NEAR Intents, but seized on the logic loopholes in the interaction between Omni's deposit and withdrawal infrastructure and the NEAR Intents contract. The attack was strictly limited to the USDT asset pool on BNB Chain. The hacker siphoned off about 3.87 million USDT in a very short period of time and quickly transferred it to the exchange to exchange it for Bitcoin.
It is worth noting that the official emergency response and engineering disposal reflect a high level of maturity.
The team locked down the specific vulnerability and completed the hot fix within 1 hour after detecting the anomaly; and quickly suspended the deposit and withdrawal functions of 11 networks involved in Omni's repair (such as BSC, Polygon, Avalanche, etc.) and conducted a security isolation investigation for about 12 hours.
Most importantly, the official has made a clear commitment to provide 100% compensation to all damaged users.
The short-term market has fallen, but the fundamentals have not changed much
The security incident directly triggered selling pressure in the secondary market. Affected by the news, the price of $NEAR fell from around US$5.5 to around US$4.74, a drop of 6%–8%.
From the perspective of trading games, this decline is more of an emotional realization of profit-making orders based on bad news.
Looking back at the trend in September, NEAR experienced an explosive unilateral rise. There are two core driving forces: one is the release of the new narrative of "Confidential Intents"; the other is the expected listing of Bitwise spot NEAR ETF in the United States. After accumulating a large amount of profit-making chips in the short term, there is a need for a technical correction on the market itself.
From a fundamental volume comparison, NEAR Intents officially disclosed that its monthly transaction and payment processing volume has exceeded US$4 billion. This exposure of US$3.8 million accounts for a very low proportion of the total turnover (less than 0.1%), and since the official compensation was paid in full, this loss has been internally digested and will not be transmitted externally to trigger a series of liquidations or a spiral of bad debts in the DeFi lending ecosystem.
Therefore, this dip has identified a short-term panic bottom. As the deposit and withdrawal functions of 11 chains are gradually restored, and the subsequent complete post-mortem analysis report (Postmortem) is released, there is a high probability that funds withdrawn due to risk aversion will be replenished.
Intents are the Achilles’ heel of narrative
This incident went beyond a simple hacker attack and touched upon the core pain point in the evolution of current encryption infrastructure: the security paradox of "no bridge" and "cross-chain".
Bankless co-founder David Hoffman commented that hacking of centralized exchanges and cross-chain bridge vulnerabilities have always been the two most costly hidden dangers in the encryption industry. The NEAR team can quickly patch and pay full compensation within hours, which reflects top engineering capabilities.
But as encryption community researcher Warden pointed out: "No matter how perfect the outer wrapper is, the cross-chain seams are still the scariest place."
In the "Intents" narrative, users' complex cross-chain operations are abstracted and handed over to solvers (Solvers) for processing in the background, making the front-end experience as smooth as a centralized exchange.
However, the final settlement and mapping of assets between different heterogeneous chains still rely on the underlying treasury and deposit and withdrawal interfaces.
These "seams" are the most fertile targets for hackers. The front-end SHIELD AI had just used big data to catch external money laundering movements, and the rear-end hackers used the lowest level contract logic loopholes to sneak into the vault.
With the intervention of AI, the offensive and defensive battles in the encryption field are entering a high-dimensional era. Whether it is full-chain abstraction or confidential intent, the larger the business logic, the more boundary seams there are.
Before thorough engineering specifications and formal verification are popularized, the absolute security of cross-chain assets is still a false proposition.
Therefore, for currency holders, there is no need to panic excessively in the short term and focus on tracking three landing nodes:
Whether the US$3.8 million in compensation funds officially promised by NEAR will be fully realized;
Whether the 11 chains that have suspended deposits and withdrawals will resume interaction after 12 hours as stated;
Whether the subsequent post-mortem review report can completely eliminate the potential risks of other on-chain interactions from the architectural level.