Was NEAR Hacked? The NEAR Intents Exploit and the October Drop

The NEAR blockchain was not hacked in October 2026. On October 1, an attacker exploited a bug in NEAR Intents, a swapping app built on top of NEAR, and took about $3.8 million in USDT on BNB Chain. According to the video, the money was returned by October 2, and users were covered in full.

So why did NEAR still fall by double digits on October 8 and 9? The Bullrunners video, hosted by George Lee, argues the answer had little to do with the exploit. Over $1 billion in leveraged bets were wiped out across crypto, and an old exploit headline happened to sit next to a fresh red candle. For a holder, knowing which story actually moved the price is the difference between a calm decision and a panicked one.

What happened to NEAR on October 8 and 9, 2026?

NEAR fell with the rest of the crypto market as more than $1 billion in bets were liquidated, according to market records cited in the video. At the same time, social media posts and videos about a “NEAR exploit” were still circulating, even though that story had wrapped up nearly a week earlier.

The video lays out three beliefs many people held on those days:

1. NEAR got hacked.
2. The hacker walked off with millions.
3. The hack is why the price fell.

According to the video, the first two are wrong and the third is only partly right.

What is a liquidation and who got wiped out?

A liquidation is when an exchange automatically closes a trader’s borrowed bet because their losses have eaten through their deposit. That deposit is called margin. A bet that the price will rise is called a long.

The video gives a simple example. Someone puts in $1,000 of their own money and borrows $9,000, so $10,000 is riding on NEAR going up. That is 10x leverage. If NEAR drops around 10%, their $1,000 is gone. In practice the exchange closes the position just before that point, so the trader loses most or all of it and never gets to wait for a bounce.

That forced selling pushes the price down, which can trigger the next trader’s liquidation, and the next. The video plays a December 2021 CNBC clip in which Kate Rooney described this as a cascade, quoting someone who called it a “liquidation train.”

On October 8 and 9, 2026, the people liquidated were mostly traders who had borrowed to bet on higher prices. According to Crypto Briefing, as cited in the video, bets on Ether took the brunt of it. If you want to go deeper on how leverage turns small moves into total losses, see our piece on lessons from the $19B liquidation.

The key point for ordinary holders: if you own NEAR with nothing borrowed against it, you cannot be liquidated. Your coins can drop in value, but nobody can force them to be sold.

Was NEAR actually hacked?

No. The exploit hit NEAR Intents, which is an application built on the NEAR blockchain, not the blockchain itself.

On October 8, 2026, Laura Shin of Unchained interviewed the general manager of NEAR Intents, Shevchenko, who offered an analogy: NEAR is like Ethereum, NEAR Intents is like Uniswap, and near.com is like uniswap.org. If Uniswap had a bug, nobody would say Ethereum got hacked.

In plain terms, NEAR Intents is a swapping service. You say what coin you have and what coin you want, possibly on a different blockchain, and it finds a deal. According to Shevchenko, wallets such as Ledger and Trust Wallet use it behind the scenes, so many people use it without knowing the name.

What did the attacker take, and how?

The attacker took USDT, a dollar stablecoin, on BNB Chain, not NEAR tokens. According to Shevchenko, the attacker sent a specific set of transactions that tricked the infrastructure into believing assets had been deposited. The smart contracts on the NEAR side then recorded a balance that did not exist.

The bug sat in the bridging system, the plumbing that moves coins between blockchains. The video compares it to a cash machine crediting your account for an envelope you never put in. Shevchenko said the team spotted the problem and reacted in about 40 minutes.

Shevchenko also said the code had been audited several times and the auditors still missed the flaw. That is a real risk with any app that moves money between chains, and bridges have been behind some of the largest losses in crypto. Our article on the KelpDAO and LayerZero bridge lawsuit looks at what happens when a bridge fails. But as the video stresses, a fault in an app is a different kind of risk from a fault in the blockchain underneath it.

How did NEAR Intents get the money back?

NEAR Intents recovered the funds within about a day by contacting the attacker directly. The timeline, as described in the video:

1. October 1, 2026: NEAR Intents pauses its services after the exploit of about $3.8 million and says it will compensate affected users in full.
2. About 12 hours later: According to Unchained, NEAR Intents posts a message to the attacker, “We have identified you, sir,” with a 48-hour window to return the money.
3. Contact: According to Shevchenko, after the attacker signaled on-chain a willingness to talk, the team posted an encrypted message only the attacker’s key could unlock, containing an invite to a private chat. The attacker joined and said he intended to return the funds.
4. By October 2, 2026: NEAR says the money is back and closes its investigation.

There was a twist. Some of the funds came back as Monero, a privacy coin, and in the interview released October 8, Shevchenko said the team was still working out how to convert it. He was clear about who carried the risk in the meantime: the bug was in the protocol, so it was the team’s fault, not the users’. He said the team replenished the smart contracts from its own pockets.

Shevchenko also said several bug reports came in afterwards through NEAR Intents’ reward scheme for finding flaws, one was genuine, and the team planned to pay out on it.

Why did NEAR fall if the money came back?

Mostly because nearly the whole market fell. When more than $1 billion of bets are liquidated, the forced selling does not check which coins have good news, and the video notes smaller coins like NEAR often swing harder than Bitcoin.

In a CNBC clip shown in the video, Frank Chaparro of The Block explained why crypto drops can run so fast: higher volatility, no circuit breakers like in traditional finance, and a market that never closes, so there is little chance for information to be digested once a cascade starts.

The exploit story still lingered. On October 1, one headline paired NEAR’s price slipping below $5 with the word “exploit.” On October 6, a YouTube video was still titled as if the exploit had just happened, even though its own description said the funds were returned in full. An old frightening word next to a new red candle invites people to connect dots that are not connected.

The video is careful not to overclaim: some people probably did sell because of the headline. But the money had been returned almost a week earlier, and the whole market fell together.

One safety note from the video: scammers love hack headlines because they give a believable reason to contact you. If a swap through a wallet that uses NEAR Intents looked odd around October 1, go to the official NEAR Intents account or your wallet’s own support page, and never deal with anyone who messages you out of the blue. Our guide to crypto recovery scams covers how these approaches usually work.

A two-part check for your own accounts

The video offers a quick check that takes less time than reading this article.

Part one: can anything you hold be liquidated?

1. Open the exchange app where you hold crypto.
2. Look for anything called futures, margin, positions or loans.
3. If nothing is there, nothing you hold on that app can be liquidated. A price drop can still hurt, and coins lent out through earn products carry their own risks, but nobody can force-sell your holdings.
4. If something is there, find the liquidation price, write it down, and ask yourself honestly how close it is to the current price.

Part two: when you see “hack” next to your coin

Go to the project’s official account and answer three questions:

Question	NEAR, October 2026
Was it the blockchain or an app built on top?	An app (NEAR Intents)
Which coins were taken?	A dollar stablecoin (USDT)
On which blockchain?	Another chain (BNB Chain)
Are users being covered?	Yes, according to NEAR Intents

Those answers describe a very different event from “NEAR got hacked.”

What to watch next

None of this means NEAR cannot fall further, or that every app built on it is safe. The video’s point is narrower: know which story you are reacting to before you hit sell.

For NEAR holders, the open items are whether NEAR Intents finishes converting the Monero it received, whether it pays out on the genuine bug report, and how its bridging code is reviewed going forward. On the market side, watch for signs of heavy leverage building up again, because the next liquidation cascade will drag down coins with good news and bad news alike.