NEAR Intents Blocked $50M of Bitget Theft, Then Lost $3.8M to Omni Bug
NEAR Intents blocked over $50 million in Bitget-hack transfers, then two days later lost about $3.8 million to a bug in its Omni deposit layer.
Why it matters
The pair of incidents pits permissionless design against theft recovery: protocols that refuse to censor addresses can still launder hacked assets, while one that intervened lost user funds to a bug days later, and Cointelegraph notes the debate over who can authorise release of NEAR Intents' frozen balances. Attacker behaviour shifted to Zcash shielded pools, which cut the public transaction trail investigators rely on. No confirmed link between the Bitget theft and the Omni exploit has been established.
Where the sources disagree
NEAR token price after the $3.8 million exploit
-6.7% to $4.96
Decrypt
from $5.1 to $4.79
Protos
Decrypt reported the NEAR token falling 6.7% to $4.96 while Protos recorded a drop from $5.1 to $4.79 in the minutes after disclosure.
Identity of the Bitget attackers
speculated as North Korean by Gracy Chen
Cointelegraph
closely matches known North Korean hacker patterns (Bankless assessment)
Bankless
Bitget CEO Gracy Chen said North Korean hackers may have been responsible, while Bankless described the attack as closely matching known North Korean patterns and Decrypt calls the Bitget thief North Korea-linked, but no attribution has been confirmed.
Figures that do not reconcile
Found by comparing the numbers in the reports automatically. They are differences, not yet confirmed to be about the same thing.
amount taken
$10.7 million
Cointelegraph
$50 million
CryptoSlate
Cointelegraph reports $10.7 million, CryptoSlate reports $50 million (79% apart).
amount taken
$3.8
Decrypt
$1
Cointelegraph
Decrypt reports $3.8, Cointelegraph reports $1 (74% apart).
Key facts
Bitget revised its loss estimate for the Sept. 24 breach from $351.6 million to about $387.5 million.
387,500,000 USDDisputed figureReported by Crypto.News
NEAR Intents said its SHIELD system blocked more than $50 million in attempted transfers linked to the Bitget hack.
50,000,000 USDDisputed figureReported by Cointelegraph
SHIELD froze about $503,000 during execution while roughly $166,000 in suspected stolen funds passed through before being stopped.
503,000 USDReported by Cointelegraph
Rejected transfers worth more than $50 million went on to other service providers.
50,000,000 USDDisputed figureReported by Cointelegraph
THORChain said its emergency halt protects protocol security and does not selectively freeze individual swaps or addresses.
Reported by Crypto.News
A hacker-linked wallet swapped more than $6 million of ETH into BTC through THORChain after Bitget's request was declined.
6,000,000 USDReported by Bankless
About 2,746 ZEC worth roughly $3.9 million was moved into Zcash's Ironwood shielded pool in three Wednesday transactions, about 15% of the 18,917 ZEC stolen.
2,746 ZECReported by CryptoSlate
An attacker drained about $3.8 million from NEAR Intents through a bug in the Omni deposit and withdrawal infrastructure's interaction with the NEAR Intents smart contract, with funds sent to KuCoin and bridged to Bitcoin.
3,800,000 USDReported by Decrypt
What happened
Bitget says an attack on Sept. 24 drained about $387.5 million, an estimate it revised up from $351.6 million, and CEO Gracy Chen asked cross-chain protocols to refuse service to the attacker addresses. THORChain declined, saying on Sept. 28 that its emergency halt protects the network and is not a selective address freeze, pointing to what responsibility Bitcoin, Ethereum and BNB Chain would carry; Cointelegraph notes the protocol has retired its admin key. NEAR Intents general manager Alex Shevchenko said on Sept. 29 that its SHIELD system rejected more than $50 million in attempted Bitget-linked transfers, froze about $503,000 mid-execution and let roughly $166,000 through, with the rejected funds going to other providers. Bitget's recovery effort split after that: CryptoSlate reports about 2,746 ZEC worth roughly $3.9 million went into Zcash's Ironwood shielded pool on Wednesday, flagged by ZachXBT, while Bankless reports a hacker-linked wallet swapped more than $6 million of ETH into BTC through THORChain. On Oct. 1 NEAR Intents halted services after a bug in the Omni deposit and withdrawal infrastructure's interaction with its smart contract drained about $3.8 million. ZachXBT said the funds moved to KuCoin and were bridged to Bitcoin, and NEAR Intents said it would compensate users in full and had reported the incident to law enforcement. Co-founder Illia Polosukhin said the exploit was isolated to USDT on BSC and that SHIELD flagged the outlier behaviour and triggered the pause. Decrypt reported the NEAR token fell 6.7% to $4.96 while Protos recorded a drop from $5.1 to $4.79, and Decrypt says it is not clear whether the two incidents are connected. Shevchenko later said the attacker had been identified and was given 48 hours to return the funds.
How the story developed
- Official statement
THORChain declines to censor attacker addresses
THORChain's Sept. 28 response says an emergency halt is not a selective address freeze and asks what responsibility Bitcoin, Ethereum and BNB Chain would bear.
- First report
First report by Crypto.News
Bitget wants stolen funds blocked. Who can make a cross chain network comply?
- Update
Bitget breach and revised loss estimate
Bitget puts the Sept. 24 theft at about $387.5 million, up from an initial $351.6 million, and CEO Gracy Chen asks THORChain to refuse service to attacker addresses.
- Independent corroboration
Independently corroborated by Cointelegraph
NEAR Intents says it blocked $50M tied to Bitget hackers
- Official statement
NEAR Intents discloses $50 million block
General manager Alex Shevchenko says SHIELD rejected more than $50 million in attempted Bitget-linked transfers, froze about $503,000 and let roughly $166,000 through.
- Update
Stolen ZEC moved into Zcash shielded pool
About 2,746 ZEC worth roughly $3.9 million entered Zcash's Ironwood pool in three transactions flagged by ZachXBT.
- Update
NEAR Intents halts services after $3.8 million exploit
The protocol stops services after a bug in the Omni deposit and withdrawal infrastructure's interaction with its smart contract drains about $3.8 million; ZachXBT says the funds went to KuCoin and were bridged to Bitcoin.
- Resolution
Shevchenko gives attacker 48 hours to return funds
Shevchenko says the attacker has been identified and asked to return funds to Bitcoin, BNB/Ethereum and Solana addresses; Polosukhin says the exploit was isolated to USDT on BSC and most services are restored.
How coverage built up
Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.
- 28 Sept 2026, 13:37 UTC: Crypto.News — 1 independent source, 1 reports
- 29 Sept 2026, 01:17 UTC: Cointelegraph — 2 independent sources, 2 reports
- 29 Sept 2026, 05:45 UTC: Bitcoin Insider — 3 independent sources, 4 reports
- 29 Sept 2026, 06:23 UTC: CoinDesk — 4 independent sources, 5 reports
- 29 Sept 2026, 19:12 UTC: Bankless — 5 independent sources, 8 reports
- 30 Sept 2026, 20:20 UTC: CryptoSlate — 6 independent sources, 10 reports
- 1 Oct 2026, 15:43 UTC: Decrypt — 7 independent sources, 11 reports
- 1 Oct 2026, 18:18 UTC: Protos — 8 independent sources, 13 reports
- 2 Oct 2026, 15:58 UTC: CryptoPotato — 9 independent sources, 14 reports
- 3 Oct 2026, 07:30 UTC: Crypto News Flash — 10 independent sources, 15 reports
Affected entities
Also mentioned: Circle, Uniswap, KuCoin, TRON, Solana, Polygon, Optimism
Original sources
Related events
Binance Opens Spot Trading in Hyperliquid's HYPE With Three Pairs and Seed Tag
Binance listed Hyperliquid's HYPE token for spot trading on 24 September 2026 in three pairs, with withdrawals due 25 September and a Seed Tag risk label.
StakerX's AI Agent Surpasses Passes $40M Staked Assets on Solana Within Three Months of Launch
Bitget resumes bitcoin withdrawals four days after $387.5 million breach
Bitget reopened bitcoin withdrawals at 08:00 UTC on Sep. 28 after a Sep. 24 breach that moved about $387.5 million to attacker-controlled addresses.
Bitget Says $351.6M Wallet Breach Took 102.93M XRP; Attacker Linked to North Korea
Bitget says a backend wallet breach on Sept. 24 drained about $351.6M, mostly XRP, and it is investigating a North Korea link.
Duelbits Confirms About $7M Hot Wallet Drain Across Four Blockchains, Site Offline
Duelbits confirmed a roughly $7M hot wallet hack on Thursday, pulled its site offline and says user funds are safe while blockchain trackers dispute the amount stolen.
North Korea-linked SquidSquad suspected in $2.84M BNB Chain theft
Blockchain investigator ZachXBT attributes a $2.84 million BNB Chain theft to North Korea-linked group SquidSquad, tracing funds through Tornado Cash to Tron wallets tied to prior North Korean addresses.