Incident case file

NEAR Intents — Omni withdrawal-signing bug drains BNB Chain vault

Incident date Sep 30, 2026Last updated Oct 8, 2026

5 views

ResolvedBNB Chain L1 (EVM) — proceeds moved to BitcoinEthereum and exchangesBridge logic flaw (signed-note withdrawals)Cluster: NEAR-OMNI-2026-09

Estimated loss

$3.8M

Affected users

Group joining is coming soon.

Investigation

75%

Facts and investigation

Ledger

Attacker

0x09Fd1f5d9F185067A92493E43AA259ea4AB3ad37 (BNB Chain; BscScan label 'Near Intents Exploiter 1', identified by ZachXBT and several outlets). No attribution to any group: the reported link to a Lazarus-labelled address is unconfirmed and resembles address poisoning.

Funds moved to

3,865,021 BSC-USD (7 transfers) left the vault. About 2,570,032 USDT were swapped for 3,325.4 BNB: 1,070,031.76 USDT sent to 0xc590175E458b83680867AFD273527Ff58f74c02b and 1,500,000 USDT to 0x9008D19f58AAbD9eD0D60971565AA8510560ab41. 929,999.00007 USDT went to 0xde85b9599d8324ffa4ba2792ebd4d8298b576b1c, 330,000.00038 USDT to 0x62eb7ae0afa102bc1252a7cd9677486bb8df98af and 34,998.97 USDT to 0x168f364cf8da2105b99407cf817660a8450cf3b7. BNB went on as follows: four deposit forwarders that feed KuCoin

Linked

Victim vault 0x233c5370CCfb3cD7409d9A3fb98ab94dE94Cb4Cd (BscScan label 'HOT Bridge: Treasury'); NEAR Intents address 0x2CfF890f0378a11913B6129B2E97417a2c302680. The seven vault withdrawals: 0x4f426e23cda7ab58fd146f4f81489575563770c5d25b49d156870dc1dc1428d5 (10 USDT, test), 0xc002bd17fb1d46833088c4deb2e05949fc33bdbd9f95ff53295af0c8f68bfdbf (11 USDT, test), 0x9fe58e031f73bbd880c782bc9e7446bcda32cadb304a729209871a4a81856c4c (800,000), 0x0381265d6a1bb09de899f49f410a8b907cd548358a7e3c91076c3a52656b8220 (1,200,000), 0x69d1c68c7e961a0199d3c9f3b6a31cb168ed775ef34b51a42762253ac1efcceb (1,500,000), 0x9c10b967da0c85631ec105e3b322c0a851fcd01b69ff390ff58f860e5cce003a (330,000), 0x16ddfa695b9525662b8e57c35723f44af89b4e7fc2dedc3634f730caf8b90c02 (35,000). Return addresses published by Alex Shevchenko: BTC bc1qjhv3hu8rfteh5e8exfmalvx2z3pzlmjlgnzxey, BNB/ETH 0xB18a1aEDfde8B70FD67012C9E9c7a088B4d0C0e7 (BscScan label 'Near Intents: Recovery Wallet'), Solana AHTfKaeRcaK1sbSG8MFJS2uPxLBChfenigNtvbWEkhKD. Message transaction 0x86517ba35a949d14155f058844a2fa4e35301d5dab2b636fe7645e85c22fe10b (1 BNB with a cooperation message, Oct 2 at 10:22:18 UTC), funded 53 seconds earlier by 0xFbC13c7e56021703CF2109C487834A685FDcE30e; a second data-bearing transfer of 0.03872695 BNB followed at 16:15:28 UTC (tx 0x3b9b3cc9e53ae9ad97850c2b8f3e19259d97834210858f467bfc377f2aeeb3af): this is not the return of the funds, which happened on Bitcoin. The attacker address was massively address-poisoned (look-alike recipients, fake tokens); none of those look-alikes is a real destination.

Chronology

1 beat

Sep 30, 2026 at 18:57:07 and 20:05:24 UTC the attacker address received two test withdrawals of 10 and 11 USDT from the NEAR Intents BNB Chain vault. At 23:54:30 UTC a first 800,000 USDT withdrawal followed, then 1,200,000 at 00:24:02, 1,500,000 at 00:50:42, 330,000 at 01:46:20 and 35,000 at 06:08:26 UTC on Oct 1, 3,865,021 USDT in total. Within minutes the USDT were swapped to BNB and split across fresh wallets, bridged, sent to deposit forwarders feeding KuCoin, to a Hyperliquid account and to Bitcoin (about 34.69 BTC). Around 12:53 UTC on Oct 1 NEAR Intents confirmed a roughly $3.8M incident in its Omni deposit/withdrawal infrastructure, paused 11 networks and promised full compensation. Overnight Oct 1-2 GM Alex Shevchenko said the exploiter had been identified, gave a 48-hour ultimatum and published three return addresses. On Oct 2 at 10:22 UTC the exploiter sent 1 BNB to the recovery wallet with a message asking for a private channel (Signal). Later that day NEAR Intents announced that all funds had been returned (34.589 BTC reported) and closed the investigation; this was not independently verified. No attribution has been confirmed.

Sources and coverage

Victim testimonies

No testimonies yet.

+ Add my testimony → (coming soon)