$3.8 Million Back From the Attacker: Why the NEAR Price Is Up 7.8 Percent

The attacker who drained about $3.8 million from the cross-chain service NEAR Intents on October 1 has sent the money back in full. Since then the price of NEAR Protocol has turned higher: $5.23 on Tuesday morning, October 6, 2026, a gain of 7.8 percent within a day and of 14.4 percent over the week. Those are CoinGecko's figures. That made NEAR the only coin among the 25 largest crypto assets excluding stablecoins to move more than five percent on the day that morning.

Two documented developments coincide here, and both are older than the price jump: the full return of the drained sum, and the launch of the first US spot ETF on NEAR on September 29. How much each contributes cannot be separated out. What can be said is this: the risk that sat on the token for a week, worth $3.8 million, is off the table.

The Omni flaw at NEAR Intents: $3.8 million via BNB Chain

The incident on October 1 did not hit the NEAR blockchain itself but a service running on it. The affected part was the Omni infrastructure that handles deposits and withdrawals at NEAR Intents. The flaw sat in the way that infrastructure communicated with the smart contracts. The outflow stayed confined to BNB Chain, and the bulk of the haul consisted of the stablecoin USDT.

What NEAR Intents does technically

NEAR Intents is a service for swapping crypto assets across network boundaries. An intent is a statement of purpose: you define what you want to end up with, and a network of service providers finds the route there. Unlike a classic bridge, no token is locked in a contract on one side and reissued on the other. The technical description is set out in the project's technical documentation.

That the attack hit the settlement layer and not the protocol is more than a nicety. Anyone who held NEAR in their own wallet and never used the swap service was untouched by the outflow. What was affected were funds sitting in Omni settlement. The team has pledged to compensate affected users in full.

The service's security layer flagged the access itself, after which NEAR Intents was shut down for about an hour. During that time the gap on the contract side was closed. Core functions ran again afterwards, while individual cross-chain functions stayed switched off during the repair. We described the withdrawal halt and its reasons in detail on October 1.

A 48-hour ultimatum: how the attacker was identified

Within 24 hours of the outflow the team had, by its own account, identified the person behind the access. It then set a 48-hour deadline for the return of the funds and published addresses the money was to go to. This is standard practice in the industry: it leans on the threat of prosecution while leaving the other side a way out.

The way out was taken. A few hours after the deadline was set the other side signalled willingness to talk, and the full sum came back within the time allowed. The team then closed its investigation.

A caveat belongs with that. A return after an ultimatum is no proof that the tactic works reliably. In many cases over recent years the money stayed gone. At NEAR Intents several things came together: the trail was fresh, the sum was small relative to the risk of being found, and the outflow was confined to a single chain.

Bug bounty instead of exploit: the words of Shevchenko and Polosukhin

Alex Shevchenko, general manager of NEAR Intents and co-founder of Aurora Labs, confirmed the return publicly and tied it to an appeal: “The funds from the $3.8M NEAR Intents hack were sent back in full. We are stopping the investigation. Please use bug bounties instead of disrupting the services.”

Illia Polosukhin, co-founder of NEAR Protocol, echoed that: “For security researchers looking for exploits, we encourage you to use bug bounties. They exist for a reason.” A bug bounty programme is an advertised reward for reporting a vulnerability to the operator rather than exploiting it.

For you as an investor, the admonition matters less than the fact that both statements are attributed by name and by role. In incidents of this size, figures from anonymous sources circulate routinely. Here the amount, the cause and the outcome have names behind them.

The Bitwise NRR ETF: $35.5 million of inflows on day one

The second documented reason for the demand is less than a week old. On September 29 the first US spot ETF on NEAR began trading, issued by Bitwise and listed under the ticker NRR on NYSE Arca. The management fee is 0.75 percent a year. Bitwise has said it will stake a substantial share of the tokens it holds.

The provider published the first trading day's figures itself: $36 million of assets under management, $35.5 million of net inflows, $15.1 million of trading volume. That bought roughly 7.2 million NEAR, about 0.55 percent of the circulating supply. The price rose 10.2 percent on the launch day to $5.38.

A spot ETF actually buys the underlying asset. Every inflow is therefore a purchase in the market that shrinks the circulating supply. For a token with around 1.31 billion units in circulation, 0.55 percent in a single day is a size you cannot argue away. The reverse applies just as much: outflows become sales.

The NEAR price in detail: $4.87 to $5.35 in one day

The day's range ran from $4.87 to $5.35. That is just under ten percent between low and high within 24 hours. Turnover of around $961 million stands against a market capitalisation of about $6.85 billion, which put NEAR in 21st place.

For context on the upside: the all-time high of $20.44 dates from January 16, 2022. From current levels that is around 290 percent away. Anyone reading the term all-time high in a forecast should read that date alongside it, because it is more than four years back.

The comparison with the wider market is what makes the move interesting. Bitcoin was virtually unchanged the same morning, and so was Ethereum. The rise in NEAR therefore did not come out of a general market move but out of its own news flow.

Buying NEAR in Europe: MiCA authorisation and a euro pair

If you want to buy NEAR in Germany, two practical questions decide the cost. The first is authorisation: now that the EU regulation MiCA applies in full, providers of crypto services need a licence from a European supervisor, in Germany from BaFin. Which firms hold that licence and what they charge is set out in our crypto exchange comparison.

The second question is the trading pair. If NEAR trades against the euro, you pay a trading fee once. If the route runs via the dollar or a stablecoin, conversion and spread are added on top, and for a coin showing a ten percent range in a day, the time lost between two steps weighs in as well.

A third point concerns the very subject of this article: cross-chain services are convenient, but they add a layer that can have faults of its own. If you simply want to buy NEAR and hold it, you do not need them.

Custody after a cross-chain exploit: your own keys or an exchange account

The incident is a lesson in where crypto assets sit. Three places need to be distinguished. On an exchange they sit in the provider's name; in your own wallet they are your responsibility; and in a settlement service such as the Omni layer they sit temporarily in a contract while a swap runs. The third place is the shortest-lived and the least considered.

In practice that means this: a balance caught up in a swap is not part of your holdings but part of a running process. Anyone who swaps across network boundaries regularly should keep the amounts small and not leave them sitting and waiting. For anything meant to stay longer, self-custody is the cleaner route; which devices qualify is shown by the hardware wallet comparison.

Holding period and tax: December 31, 2026 as the cut-off

A gain of 7.8 percent in a day raises the tax question immediately. In Germany, crypto assets currently fall under the one-year holding period of section 23 of the Income Tax Act: sell after more than twelve months and the gain from the private disposal is tax-free. Sell before that and it counts towards taxable income, provided the exemption threshold is exceeded.

That framework is up for change. A draft bill from the Federal Ministry of Finance provides for a flat 25 percent withholding tax regardless of the holding period. As the draft currently stands, it would apply only to crypto assets acquired after December 31, 2026; anyone buying up to and including that day keeps the old rule. The cabinet is due to take it up on October 14, 2026. We have broken down the draft and its timetable separately.

What this means for you depends on your time horizon, not on the day's move. A draft is not a law, and the Bundestag has not yet taken it up. Anyone who nonetheless wants to plan around the deadline should document the acquisition date of every purchase, because under a cut-off rule that date becomes the decisive piece of evidence.

Staking and a 0.75 percent fee: what separates the ETF from holding your own tokens

Bitwise intends to stake a substantial share of the ETF's tokens. Staking means pledging tokens in the network to help secure the blockchain and receiving a reward for doing so. For the fund that is income, set against the 0.75 percent management fee.

If you hold NEAR yourself you can stake too, but you carry the work and the risk alone: choosing a validator, lock-up periods when withdrawing, and the tax treatment of the income, which the draft bill explicitly wants to assign to investment income. Which platforms offer which terms is set out in the staking provider comparison.

The difference is not in the yield alone. With the ETF you buy a security in a brokerage account and hold no keys. With your own tokens you hold the keys and with them the duty to secure them.

Leverage and liquidation: 7.8 percent in a day is enough for a margin call

A range from $4.87 to $5.35 within a day is the real story for leveraged positions. At ten-times leverage a ten percent move against you is enough to consume the margin; in practice liquidation kicks in earlier, because the exchange holds a safety buffer. On Monday and Tuesday exactly those ten percent lay between low and high.

On top of that, perpetual futures carry a financing charge, the funding rate. It is settled several times a day between the buy and sell sides. After a fast rise it is typically positive, which means holding costs fall on the buy side for as long as the position stays open.

Levels above and below: $5.35, $4.87 and $4.70

On the upside the day's high of $5.35 is the next marker, and above it the ETF day's starting level of $5.38. On the downside sits the day's low of $4.87, and below that the zone around $4.70 where the recovery began.

These values are observation points, not a forecast. What they are useful for is settling on a decision in advance rather than in the moment of the move. Analyst opinions on price targets are plentiful; each belongs to the person or house that voiced it, not to the market.

NEAR after the exploit: How to proceed now

1. Settle the buying route and the fees. Check whether your provider holds a European licence under MiCA and whether a euro pair on NEAR exists. Both are in the crypto exchange comparison, and both decide more about your outcome than an entry a few cents lower.
2. Separate holdings from swap balances. What you want to hold for longer does not belong in a settlement service. The test is where the keys sit; suitable devices are in the hardware wallet comparison.
3. Decide on holding period and staking in advance. Note the acquisition date and decide whether you want to lock tokens up before you pledge them. Lock-up periods and provider terms are in the staking provider comparison.

(As of October 6, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)