Onchain Files
File #001 · NEAR Intents exploitCLOSED · FUNDS RETURNEDv1.0 · closed Oct 2, 16:25 UTC

Where did the $3.87M go?

BNB Chain→Ethereum→THORChain · Chainflip→Bitcoin

The funds were returned on Oct 2, 2026, about 40 hours after the first large withdrawal. Before that, we followed them from NEAR Intents' BNB Chain hot wallet to 34.59 BTC in five Bitcoin addresses, about three quarters of what was taken. We rebuilt the drain from raw chain data and followed it across three chains. Every figure below is tied to a transaction.

3,865,021USDTTaken in 7 signed withdrawals. Matches the reported $3.865M to the dollar.
34.59BTCSwept into one address, bc1qjh…zxey, on Oct 2 between 14:31 and 14:45 UTC. About $2.89M.
−13hThe first large withdrawal came 13 hours before the public announcement.
750BNBDeposited back into the NEAR Intents vault while it was being drained.
CLOSED · FUNDS RETURNED

Outcome

Returned · both sides say so

Last movement

Oct 2, 14:45 UTC · BTC swept

Return deadline

Met · Oct 2

Closed

Oct 2, 16:25 UTC

This file is closed. The findings stay as published; updates are logged below.

Closed v1.0 · Oct 2, 16:25 UTC. The funds were returned. NEAR Intents announced that the stolen funds were sent back in full. At 16:15 UTC the exploiter confirmed it on-chain, from the same drain wallet (0x09fd…ad37) to NEAR's recovery wallet: "We've returned all the funds, we were in the wrong. Thank you to the Near team for being respectful, constructive, and cordial during the return process. Remember to always use bug bounties!" The 34.59 BTC swept at 14:31–14:45 UTC into bc1qjh…zxey has not moved since, which fits that sweep being the return; NEAR has not published its receiving addresses, so we mark the return as reported by both parties rather than verified by us. We are closing this file and stopping our watch.

Update v0.8 · Oct 2, 15:05 UTC. The Bitcoin moved. Between 14:31 and 14:45 UTC all five holdings were swept into one new address, bc1qjhv3hu8rfteh5e8exfmalvx2z3pzlmjlgnzxey: 25.918 BTC confirmed and 8.671 BTC still waiting for a block (it pays a low fee). Nothing has left that address yet. Gathering coins into one address often comes before a larger move; it can also come before a return. We are checking it every two minutes.

Update v0.7 · Oct 2, 13:50 UTC. We traced the 120 BNB that crossed to Arbitrum through LI.FI. Forty-four seconds after leaving BNB Chain it was 90,286 USDC inside Hyperliquid, and seconds later it bought 165.3 XMR1, a token for Monero issued by Wagyu.xyz. The tokens are still in that account, worth about $90k. Redeeming them for real Monero would end the trail (F12). We checked whether this money paid for the exploiter's message: it did not; that account has sent nothing out.

Update v0.6 · Oct 2, 13:40 UTC. The exploiter answered on-chain. At 10:22 UTC the drain wallet 0x09fd…ad37 sent 1 BNB to the address reported as NEAR Intents' recovery wallet, with the note "Willing to cooperate, reply with your Signal so contact is possible." No funds have been returned. The BNB for it arrived four minutes earlier from Arbitrum, through two brand-new wallets (F11). The Bitcoin holdings have not moved.

Update v0.5 · Oct 2, 11:13 UTC. Our engine re-traced the case and we checked its new leads by hand. The 485 BNB we listed as "fresh addresses, untraced" went into five more Relay deposit addresses, so Relay received 2,318 BNB through 23 addresses, not 1,833 through 18. On Ethereum, at least 171 ETH of the Relay payouts came straight back to the drain wallets. Nothing previously published was wrong; two open questions are now partly answered (F7, F10).

The claim

"The funds were immediately transferred to Kucoin and bridged to Bitcoin."

ZachXBT, Oct 1, as reported by Protos Attributed

"A bug in the Omni deposit and withdrawal infrastructure… These funds will be compensated in full."

NEAR Intents, Oct 1 Project-reported

The evidence

  • Verified

    3,865,021 USDT left the vault in 7 signed withdrawals, starting Sep 30.

  • Verified

    Only 800 BNB (≈ $616k) reached the KuCoin-labelled wallet.

  • Verified

    4.26 BTC came from the drain wallets' Ethereum deposits through THORChain, proven by memos on both chains.

  • Inferred

    20.48 BTC matches their Chainflip deposits. Another 9.96 BTC came from payers not yet identified, so a KuCoin route for that part can't be ruled out.

  • Verified

    34.59 BTC unspent in 5 addresses at Oct 2, 08:00 UTC.

The unknown

  • Unknown

    Who produced the withdrawal signatures.

  • Unknown

    Where NEAR Intents delivered the 750 BNB deposited into it.

  • Unknown

    Who paid 9.96 BTC into the collector.

  • Unknown

    Who the operators are.

01 · The drain, then the Bitcoin

Thirteen hours before anyone said anything.

The vault paid out 3.87M USDT in seven withdrawals between Sep 30, 18:57 and Oct 1, 06:08 UTC. Bitcoin started arriving at a single collector address at 02:59 UTC. Almost all of it had arrived before NEAR Intents announced the incident at 12:53 UTC.

USDT withdrawn from the vault, cumulative

Hover for each event

Chart loading…

BTC arrived at the collector bc1qsyrc…tsn8, cumulative

24 incoming transactions

Same time axis on both charts (UTC). The dashed line marks NEAR Intents' public announcement.

02 · Key findings

What the chain shows.

F1

Three quarters of the money became Bitcoin, and at our Oct 2 snapshot it had not moved since Oct 1

Verified

Between 02:59 and 13:00 UTC on Oct 1, 34.69 BTC arrived at one Bitcoin address in 24 incoming transactions. It was then split into new addresses. At the snapshot, 34.59 BTC sat unspent in five of them. Bitquery reported the same 34.69 BTC in four wallets at its Oct 1 snapshot. Since then two of those wallets moved their BTC on, which is why we count five at Oct 2.

Evidence: Bitcoin section below, all five addresses with balances.

F2

The Bitcoin route runs through the drain wallets' own addresses on Ethereum

VerifiedChainflip payout inferred

The same addresses, 0x09fd…ad37 and 0xde85…6b1c, are active on Ethereum. They sent 642 ETH into 18 single-use contracts that forward to "Chainflip 1", and 132.8 ETH to THORChain. The THORChain leg is proven by memos on both chains. The Chainflip payout to Bitcoin is matched on timing and amount only.

Evidence: ETH 0xa10c7bc3…8578 ↔ BTC a19f6862…7faf (memo OUT:A10C7BC3…)

F3

The drain started Sep 30, after two test withdrawals

Verified

10 USDT at 18:57, 11 USDT at 20:05, then 800,000 USDT at 23:54 UTC on Sep 30. Four more withdrawals followed on Oct 1. The total is exactly 3,865,021 USDT. Bitquery counts five withdrawals because it leaves out the two tests.

Evidence: withdrawals 1–7 in the ledger.

F4

The vault paid out because it was handed signed withdrawals

VerifiedMechanism unknown

The drain wallet called the vault directly. Each call named a token, a recipient and an amount, with a 65-byte signature, and the vault accepted all seven. That fits NEAR Intents' statement that the bug sat in the Omni deposit and withdrawal system. Who produced the signatures is for the postmortem.

Evidence: input data of 0x0381265d…8220.

F5

750 BNB went back into the vault being drained

Verified

Three new wallets deposited 300, 350 and 100 BNB into the NEAR Intents contract between 01:15 and 02:36 UTC on Oct 1. The 650 BNB came through CoW Eth Flow orders placed seconds earlier. The total matches Bitquery's figure. Where NEAR Intents delivered those funds is not visible on BNB Chain.

Evidence: 0xb6bca515…3144, 0x281f0bb8…83eb, 0xa11b8bfd…270a.

F6

About 800 BNB reached a wallet labelled KuCoin, and 150 BNB one labelled HitBTC

VerifiedExchange labels attributed

800 BNB passed through 0xcd87…b262, which forwarded every payment within minutes to the wallet Etherscan labels "KuCoin 28". Bitquery reported about $802k to KuCoin across two routes at its Oct 1 snapshot. We have confirmed one route, worth about $616k.

Evidence: e.g. 0x0e0058d9…c68c.

F7

23 single-use deposit addresses belong to Relay

Verified

2,318 BNB went into one-time addresses that were emptied within seconds into Relay's contracts: 1,833 BNB in 18 addresses from the drain wallets, and 485 BNB in 5 more from 0x36b4…de7a Updated v0.5. Relay's own records for 13 of them show USDT or USDC coming out on Ethereum.

Evidence: BSC 0x1aeb17e8…9d84 → Relay request 0x1790…4c4c → ETH 0x0123691d…3670.

F8

Two wallets sent dust to an address labelled Lazarus. This does not establish attribution

No attribution

On-chain, the reported "Lazarus link" is two small payments into the labelled address: 0.001 BNB at 13:34 and 0.049 BNB at 13:37 UTC, after the announcement. Anyone can send money to any address.

Evidence: 0x12deb304…1287, 0x58895b5b…a982.

F9

Look-alike addresses copied the drain wallet's transfers

Verified

Addresses sharing the first and last characters of the real destinations sent zero-value USDT and fake "USDT" in matching amounts (500,000, 429,999, 329,999). This is address poisoning. We filtered it before counting any flow.

Evidence: e.g. 0xde8546d3…6b1c imitating 0xde85b959…6b1c.

F10

The Relay money came back to the drain wallets as ETH New in v0.5

Verified for 6 of 126 routes unresolved

On Ethereum, each Relay payout we could follow landed in a single-use forwarder contract. Within about a minute a contract named "Sweeper" swept it, swapped the USDT for ETH through a shared execution contract (0x067c…0c67) and delivered the result. Six of those deliveries went straight back to the drain cluster: 24.08 ETH to 0x09fd…ad37, 115.73 ETH in four payments to 0xde85…6b1c, and 31.20 ETH to 0x36b4…de7a. That is 171.01 ETH that crossed to Ethereum through Relay and returned to the same wallets that fed Chainflip and THORChain. Where the other six sweeps delivered is not resolved yet. 0x067c…0c67 is a busy shared contract, not an attacker address.

Evidence: ETH 0xc73010ea…e25f (114,475 USDT → 42.44 ETH to 0xde85), 0xfa8fec3e…be24 (→ 24.08 ETH to 0x09fd), 0xf7813d28…45af (→ 31.20 ETH to 0x36b4).

F11

The exploiter replied on-chain, paid for through Arbitrum New in v0.6

VerifiedRecovery wallet as reportedOriginal source unresolved

At 10:22:18 UTC on Oct 2 the drain wallet 0x09fd…ad37 sent 1 BNB to 0xb18a…c0e7, reported as NEAR Intents' recovery wallet, with this text in the transaction: "Willing to cooperate, reply with your Signal so contact is possible." It is a message, not a return; no funds have come back. The BNB for it took a short, deliberate path: 813.43 USDC left a brand-new Arbitrum wallet (0xc9a9…bbb6) at 10:18:22 through LI.FI and a Mayan Swift order, arrived as 1.046 BNB at another brand-new wallet (0xcb4a…fef6) at 10:18:27, passed through a third (0xfbc1…e30e) at 10:20 and reached the drain wallet at 10:21:25. Each of those wallets had no history. The Arbitrum wallet's USDC came from 0x7405…f6fc, which pays users on Arbitrum and is repaid minutes later through Hyperliquid's Bridge2 contract: the pattern of a fast-withdrawal service. Which Hyperliquid account it served here is not yet resolved.

Evidence: BSC 0x86517ba3…e10b (message), 0x8e1c34fe…70fe, 0x7e0aae87…1281, 0x8e740a75…6eb5 (Mayan fill, order 0x16689aea…375d); Arbitrum 0x2baf42f6…1fb1 (LI.FI → Mayan, 813.43 USDC).

F12

The 120 BNB became Monero tokens on Hyperliquid in 44 seconds New in v0.7

VerifiedXMR1 issuer as named by Hyperliquid

At 00:54:43 UTC on Oct 1, 0x0e77…8616 sent 120 BNB into LI.FI. LI.FI and Mayan delivered 90,285.96 USDC to the same address on Arbitrum at 00:54:48. At 00:55:01 that address deposited all of it into Hyperliquid, moved it to its spot wallet, and between 00:55:19 and 00:55:27 bought XMR1 four times for 90,281.68 USDC at about $546. XMR1 is listed on Hyperliquid as "XMR - Wagyu.xyz", a token that stands for Monero. The account still holds 165.30 XMR1 and 4.28 USDC; it has made no transfer or withdrawal. Redeemed for Monero, the money would leave the public record, so this account is now watched. It did not pay for the Oct 2 message (F11), which came out of Hyperliquid through a different, unidentified account.

Evidence: BSC 0x145e137c…bb57; Arbitrum 0xd631c308…ba64 (USDC in), 0xcee78a68…ee5a (deposit to Hyperliquid Bridge2); Hyperliquid account 0x0e77cbf891b90c73e2fc5dff6d78ec2e383c8616: deposit, spot transfer and fills 0x81f121f9…1fe2, 0x500f3153…3b2b, 0x37ec1223…9838, 0x5c38d06e…c5b0.

03 · Money flow on BNB Chain

How 3.87M USDT became BNB, and where the BNB went.

Left to right: the vault, how the USDT was converted, then the first exit for each part of the BNB. BNB is valued at about $770, the price the drain wallet got in its own CoW Protocol fills. Exit values are approximate.

Stolen value by route, USD

Hover a band for amounts and evidence

Chart loading…

"Other" covers gas, slippage and routes under $50k. v0.5: the band once labelled "fresh addresses, untraced" (≈ 485 BNB) is now part of Relay.

04 · Across chains

Every edge shows its evidence. Click one.

A grey line is a transfer we read on-chain. A green line is a cross-chain link proven by records on both chains. A dashed line is our inference.

BNB CHAIN ETHEREUM CROSS-CHAIN BITCOIN 3,865,021 USDT 7 withdrawals 34.59 BTC NEAR Intents vault BSC · 0x233c…b4cd Drain wallet · BSC 0x09fd and 0xde85 Relay deposit addresses 23 single-use · 2,318 BNB MetaMask Bridge Bridgers adapter · 760 BNB NEAR Intents vault 750 BNB back · onward unknown KuCoin-labelled wallet 800 BNB via 0xcd87…b262 HitBTC-labelled wallet 150 BNB LI.FI → Hyperliquid 120 BNB → 165.3 XMR1 USDT on Ethereum swept to ETH · 171 ETH back Drain wallet · ETH same 0x09fd and 0xde85 Chainflip deposits 642 ETH → ~20.5 BTC THORChain 132.8 ETH → 4.26 BTC Unidentified payers 9.96 BTC · origin open Bitcoin collector 34.69 BTC received One address swept Oct 2 · unspent

Click or tap any line in the map to see its evidence: status, transactions, time and amount.

Verified transferDirect cross-chain linkInferred linkExchange label, attributed

05 · The Bitcoin end

34.69 BTC in, one collector, five holdings.

All Bitcoin payouts landed at one address, bc1qsyrc…tsn8. From there it was split into new addresses, after a small 0.25 BTC round-trip test. On Oct 2, 14:31–14:45 UTC, the five holdings were swept back into one address, bc1qjh…zxey (v0.8). The chart shows the holdings before that sweep.

Bitcoin by source and current holding, BTC

Hover a band for amounts

Chart loading…

The taproot vault's link to Chainflip is inferred from timing and amounts. Intermediate split addresses (bc1qzsrx…, bc1qjkdz…) are folded into their final holdings.

Holding addressSince (UTC)ShareBTC≈ USD
Unspent at Oct 2, 08:00 UTC. A further 0.1 BTC moved on via bc1q4m4c…0n6.34.58941357$2.89M

06 · Evidence map

Every link, and what supports it.

LinkEvidenceStatus
Vault → drain wallet7 vault transactions carrying signed withdrawal instructionsVerified
USDT → BNBCoW Protocol trade events, swap-router transactionsVerified
BSC → Relay → USDT on EthereumRelay's request records plus transactions on both chains (13 of 23 addresses)Verified direct link
Relay payouts → back to the drain wallets as ETHSweep transactions: forwarder → swap → ETH delivered to 0x09fd, 0xde85 and 0x36b4 (6 of 12 sweeps, 171.01 ETH)Verified
BSC → drain wallet's Ethereum addressMetaMask Bridge (Bridgers) calldata naming the same address as recipientVerified direct link
750 BNB → NEAR Intents vaultDeposit transactions into 0x233c…b4cdVerified
800 BNB → KuCoinTransfers and sweeps verified; "KuCoin 28" is an Etherscan labelAttributed
150 BNB → HitBTCTransfers verified; "HitBTC hot wallet" is a BscScan labelAttributed
Ethereum → Chainflip deposit contractsDeposits verified; contract code forwards to the address labelled "Chainflip 1"Verified
Chainflip → Bitcoin collector (~20.5 BTC)Timing and amounts match; no readable record links the twoInferred
Ethereum → THORChain → Bitcoin collector=:b:bc1qsyrc… memo on each deposit, OUT:<tx hash> on each payoutVerified direct link
Other payers → collector (9.96 BTC)Bitcoin transfers verified; who sent them is not identifiedOrigin unknown
Collector → five holding addressesBitcoin transactions; balances read at Oct 2, 08:00 UTCVerified
Drain wallets → Lazarus-labelled addressTwo dust payments into that address, after the announcementNo attribution
Verified
  • 7 withdrawals, 3,865,021 USDT
  • BSC → Ethereum → Bitcoin path, incl. THORChain memos
  • 34.69 BTC into the collector; 34.59 BTC unspent
  • 750 BNB back into the vault
  • Relay records for 13 of 23 addresses
  • 171.01 ETH of Relay payouts back to the drain wallets
Inferred
  • The 20.5 BTC taproot vault is Chainflip's (timing and amounts)
  • 0xcd87…b262 is an exchange deposit address (forwarding behaviour)
Attributed
  • KuCoin 28, HitBTC, Chainflip 1, Relay Depository labels
  • Lazarus label (PeckShield, Shield)
  • Bitquery: 34.69 BTC, ~$802k KuCoin, 2% Hyperliquid
Project-reported
  • Bug in Omni deposit/withdrawal and the NEAR Intents contract
  • Contract-side flaw patched
  • Users compensated in full
  • 48-hour return deadline
Unknown
  • Who produced the signatures
  • Where the 750 BNB was delivered
  • Who paid 9.96 BTC to the collector
  • Where 6 of the 12 swept Relay payouts were delivered
  • Which addresses received the return, and whether the 165.3 XMR1 on Hyperliquid was part of it
  • Who the operators are

Bitquery reported four BTC wallets at its Oct 1 snapshot; we observed five at Oct 2, after two of those wallets moved their BTC on. Both are correct for their time. One early article gives the drain wallet as 0x89fd…ad37, which is a typo.

07 · Timeline

In order.

Sep 28 · 20:42Drain wallet's first transaction on BNB Chain
Sep 30 · 18:57Withdrawals 1 and 2: 10 and 11 USDT (tests, 18:57 and 20:05)
Sep 30 · 23:54Withdrawal 3: 800,000 USDT, sold for BNB within four minutes
Oct 1 · 00:06BNB starts moving to Ethereum through the MetaMask Bridge contract
Oct 1 · 00:24Withdrawal 4: 1,200,000 USDT
Oct 1 · 00:50Withdrawal 5: 1,500,000 USDT, sold via CoW Protocol by 00:52
Oct 1 · 00:54120 BNB leaves through LI.FI; 44 seconds later it is 165.3 XMR1 (a Monero token) on Hyperliquid v0.7
Oct 1 · 01:15650 BNB passes through CoW Eth Flow orders into the NEAR Intents vault
Oct 1 · 01:46Withdrawal 6: 330,000 USDT
Oct 1 · 02:202,318 BNB into 23 Relay deposit addresses (until 04:33). ETH into Chainflip deposit contracts.
Oct 1 · 02:53Relay payouts on Ethereum swept into ETH until 04:34; at least 171 ETH returns to the drain wallets v0.5
Oct 1 · 02:59First Bitcoin arrives at the collector
Oct 1 · 06:08Withdrawal 7: 35,000 USDT, the last one
Oct 1 · 06:40Collector splits off 15.77 BTC and 7.88 BTC
Oct 1 · 12:53NEAR Intents announces the incident Reported
Oct 1 · 13:00Last Bitcoin payout arrives (THORChain, 1.80 BTC)
Oct 1 · 13:34Two cluster wallets send dust to the Lazarus-labelled address
Oct 1 · 19:59Last Bitcoin movement of size
Oct 2 · 00:18NEAR Intents' general manager sets a 48-hour return deadline Reported
Oct 2 · 10:18813.43 USDC leaves a new Arbitrum wallet via LI.FI and Mayan; arrives as 1.046 BNB on BNB Chain, passes two new wallets v0.6
Oct 2 · 10:22Drain wallet sends 1 BNB to NEAR's recovery wallet with the note "Willing to cooperate, reply with your Signal" v0.6
Oct 2 · 14:31All five Bitcoin holdings swept into one new address, bc1qjh…zxey, by 14:45 (8.67 BTC of it still unconfirmed) v0.8
Oct 2 · 16:15Exploiter's on-chain note to NEAR: "We've returned all the funds, we were in the wrong." NEAR Intents also says the funds were returned in full Reported v1.0

08 · Ledger

The transactions.

Key transactions on each chain. The full ground truth has 54 rows.

Key transactions
Chain · UTCEventAmountTransaction

09 · Method and standard

How we know.

On-chain figures come from public BNB Chain and Ethereum nodes, the mempool.space and Blockstream Bitcoin APIs, and Relay's public request API. To find every outgoing transaction from an address, we located the blocks where its transaction count rose, which also catches plain coin transfers that leave no event logs. Cross-chain links come from data on both chains: THORChain memos, Relay request records and forwarding addresses fixed in contract code. Exchange and protocol names are public labels. Dollar values use Oct 1 prices.

Verified

Read on-chain by us. A direct link is proven by records on both chains.

Inferred

Our deduction from patterns. The method is stated.

Attributed

Someone else's claim or label. The source is named.

Project-reported

A statement from the affected project.

Unknown

What we could not establish, listed.

Sources