Key takeaways
- NEAR Intents has halted services after reporting a $3.8 million loss — days after it froze roughly $503,000 of funds from the Bitget breach, which we covered at the time.
- Bitget's $388 million breach has pushed Q3 crypto security losses past $1 billion, per reporting.
- The pattern across these incidents is not increasing attacker sophistication. It is the same small set of structural weaknesses recurring, and the same mechanism — losses concentrating where value pools and where one component is trusted by many others.
- Separately, Treasury will reportedly let states file for stablecoin approval before finishing their own rules, and the EU has opened an enforcement action on virtual currencies in games including Minecraft.
Days ago we noted that NEAR Intents had frozen roughly $503,000 of the funds stolen from Bitget — a small but genuine recovery in an incident where most of the money was gone within minutes.
NEAR Intents has now halted services after reporting a $3.8 million exploit of its own.
There is no irony worth enjoying here. It is a useful illustration of something structural: in this industry, the component that helps recover stolen funds and the component that gets exploited are frequently the same kind of thing, for the same reason.
Why cross-chain infrastructure keeps being the target
We have written about this mechanism before and it keeps being demonstrated.
Blockchains cannot read each other. So anything that moves value between them must have something that observes one chain and asserts to another that an event occurred. That assertion step is where essentially every large cross-chain loss has happened — not in the cryptography, in the moment one system decides a claim about another is true.
Intent-based systems add a second property on top. They hold or route pooled value so that user requests can be fulfilled quickly, which means a single contract becomes a concentration of capital that many users depend on. High value in one place, with a trust assumption underneath it, is precisely the shape attackers look for.
And note the compounding effect: a protocol like this is integrated by other protocols. Its failure is inherited by everything that routed through it, which is how a $3.8 million exploit can disrupt considerably more than $3.8 million of activity.
A billion dollars in a quarter, and what that number actually says
Reporting puts Q3 crypto security losses past $1 billion, with Bitget's $388 million the largest single contributor.
The instinct is to read that as attackers getting better. The record does not support that reading. Looking at the quarter, the causes cluster into the same small set we have covered individually:
Trusted assertions. A bridge or messaging layer accepting a claim it should not have accepted, or a signer set being compromised. Structural, well understood, still the largest category by value.
Access control. A function callable by someone who should not have been able to call it. Unsophisticated, found by reading public code, and it keeps happening.
Price feeds. An oracle manipulated or stale, letting worthless collateral borrow real assets or liquidating healthy positions. Defences for this are known and not universally applied.
Operational failure at centralised venues. Keys, internal process, insider access. This is where the largest single numbers come from, because that is where the largest pools sit.
None of that is novel. Which is the uncomfortable part: the losses are not outpacing knowledge of how to prevent them. They are outpacing the willingness to spend on prevention before an incident rather than after.
The incentive problem underneath it
This is worth stating plainly because it explains the recurrence better than any technical factor.
Security spending produces nothing visible. An audit that finds three issues, a bounty programme that pays a researcher, a timelock that delays an upgrade by two days — none of those generate users, headlines or revenue. They prevent an event that, if prevention works, never happens and is never credited.
Meanwhile the competitive pressure runs the other way. Shipping faster, launching a feature first, integrating a new chain before a rival. A team that spends an extra month on review watches a competitor capture the market it was being careful about.
So the rational individual decision and the good collective outcome diverge. That is not a crypto-specific failing — it describes most industries before regulation or insurance prices the risk properly. It does mean expecting it to resolve through good intentions is unrealistic.
What this means for you, practically
Three things, none requiring a view on any specific protocol.
Count your inherited dependencies. If you hold a position through a bridge, an intent system or a wrapped asset, you carry the security assumptions of every layer beneath it. NEAR Intents halting affects anyone who routed through it, including people who never chose it directly because a front end selected it for them.
Treat duration as exposure. The longer value sits in a protocol, the longer it is exposed to every configuration change and every integration added over that period. A position with a purpose and an end date carries less risk than the same position left indefinitely.
Read how a team handled an incident, not whether they had one. Everything gets attacked eventually. What distinguishes teams is the response — full disclosure, a real post-mortem, clear treatment of affected users. NEAR Intents halting services and reporting the figure promptly is the correct behaviour, and it is worth more than a claim of never having been hit.
Elsewhere: two regulatory items
Treasury will reportedly let states file for stablecoin approval before finishing their own rules. Worth noticing because it is the sequencing problem we keep describing — applications being accepted against a framework that is not yet written. Firms will need to apply without knowing the final requirements, and then adapt to them.
The EU has opened action on virtual currencies in eleven games, including Minecraft and Candy Crush. This is not a crypto story in the usual sense and it may matter more than most: it concerns whether in-game currencies mislead consumers about real-money value. The reasoning that emerges will apply to tokenised game assets too.
The market
Bitcoin is around $83,900, effectively flat on the day and over the week. Ether is near $2,688, up roughly 2% over the week. Reporting also notes MetaMask-related security concerns pushed Ethereum validator exits to a nine-month high — worth watching as an indicator of how quickly participants withdraw from infrastructure when confidence wobbles, regardless of whether the concern proves justified.
What to take from this
A protocol that helped recover stolen funds last week has been exploited this week. That is not bad luck. It is what happens when value concentrates in components that many other systems trust.
Q3's billion dollars did not come from new attack techniques. It came from well-understood weaknesses, in systems where the spending needed to close them produces nothing anybody can point to. Until that changes, the useful response is individual: know how many layers sit beneath your position, and how long you intend to leave it there.
Frequently asked questions
Wasn't NEAR Intents one of the good actors last week?
Yes — it froze roughly $503,000 of funds from the Bitget breach, which was a genuine if small recovery. Both things are true at once. Being willing and able to freeze stolen funds says nothing about a protocol's own security, because they are unrelated properties. The ability to intervene comes from holding some control; resisting attack comes from the quality of the code and configuration.
Does $1 billion in a quarter mean attacks are getting more sophisticated?
The record does not support that. The causes cluster into the same small set: trusted assertions in bridges and messaging layers, access control mistakes callable from public code, manipulated or stale price feeds, and operational failures at centralised venues. These are well understood. The losses are outpacing willingness to spend on prevention, not knowledge of how to prevent them.
Why do the same vulnerabilities keep recurring?
Because security spending produces nothing visible. An audit finding, a paid bounty, a timelock on upgrades — none generate users or revenue, and if they work the prevented incident never happens and is never credited. Meanwhile competitive pressure rewards shipping faster. The rational individual choice and the good collective outcome diverge, which is a familiar pattern in any industry before risk is priced properly.
I never used NEAR Intents. Could I still be affected?
Possibly, and this is the point most people miss. Protocols integrate each other, and a front end may route your transaction through infrastructure you never selected. When a routing layer halts, everything depending on it is affected. That is why identifying inherited dependencies matters more than reviewing only the application you clicked on.
How should I judge a protocol's security?
Ask what mechanism asserts that an external event occurred, who can change the configuration and whether there is a delay before changes take effect, and what the bug bounty pays relative to the value held. Then read how the team handled any past incident. Everything gets attacked eventually, so the response is more informative than the absence of an incident.
Sources
Every figure and quote above traces to one of these. Checked on publication day.
- coindesk.com — NEAR Intents Halts Services, Reports $3.8 Million Loss
- cryptoslate.com — Bitget's $388M hack pushes Q3 crypto security losses past $1B
- theblock.co — Treasury will let states file for stablecoin approval before finishing their rules
- decrypt.co — Minecraft, Candy Crush Among 11 Games in EU Virtual Currency Crackdown
Deepmoni Das, Editor
I read the primary filings, exchange notices and post-mortems behind each story and write up what they actually say — with every source linked so you can check me. I am not a trader and I do not hold positions in anything covered here. Research and drafting are AI-assisted; the sourcing, the edits and the mistakes are mine.
Not financial advice. Crypto assets are volatile and unregulated in many jurisdictions. In India, gains are taxed at 30% with 1% TDS on transfers. Do your own research and never invest money you cannot afford to lose.
Editorial note: Crypto Shakti uses an AI-assisted research and drafting workflow. Every article is grounded in the linked primary sources and live market data captured at publication time.