Near Intents was exploited for $3.8M+ as per ZachXBT

[Murat]

Community Alert: Near Intents was exploited for $3.8M+ after its BSC hot wallet saw multiple irregular outflows a few hours ago.

Near Intents hot wallet 0x233c has since stopped processing transactions and the site status  (https://partners.near-intents.org/shield/status) shows an ongoing incident impacting multiple EVM chains.

The funds were immediately transferred to Kucoin and bridged to Bitcoin.

BSC theft address
0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37

Source

https://t.me/investigations/365

https://x.com/near_intents/status/2105642219357241796

[hugeblack]

According to the article, the security vulnerability involves the BNB Chain (BSC). What is striking is that BSC is considered centralized and KuCoin is a platform that requires KYC; even the NEAR Intents protocol froze transactions linked to funds stolen in the Bitget hack^[1]. Yet, despite all this centralized infrastructure, these protocols fail to secure deposits.

[1] https://thedefiant.io/news/hacks/near-intents-says-it-froze-503-000-in-bitget-hack-funds

[JeromeTash]

What kind of metallic balls does that hacker/bad actor have to even send that money to their Kucoin address? Any exchange that these days performs mandatory KYC verification for every user?
Maybe they are very confident that they used fake information to perform KYC verification, but I don't see how Kucoin can not flag such a transaction as suspicious way before they even trade or withdraw the funds.

[Faisal2202]

What kind of metallic balls does that hacker/bad actor have to even send that money to their Kucoin address? Any exchange that these days performs mandatory KYC verification for every user?
Maybe they are very confident that they used fake information to perform KYC verification, but I don't see how Kucoin can not flag such a transaction as suspicious way before they even trade or withdraw the funds.

This is not the first time. I have mentioned KuCoin several times on several occasions, that hackers have been using KuCoin since 2021. Like, I can prepare a list for you to cover almost all of them, but some of them will be:

May–July 2021 — Atomic Wallet theft
About $1.4 million in cryptocurrency was stolen from Sofia Reca, and court filings state that many of the stolen assets were later transferred to KuCoin deposit addresses believed to be controlled by the thief.
Court Filing

November 2024 — MetaWin hack
Hackers stole more than $4 million from MetaWin's Ethereum and Solana hot wallets. ZachXBT said the stolen funds were transferred to KuCoin and a HitBTC nested service.
MetaWin hack

April (not sure about the exact month, as there was some delay in reporting) 2026 — Bitcoin Depot theft
ZachXBT traced roughly 54 BTC, worth around $3.7 million, stolen from Bitcoin Depot to KuCoin wallets.
ZachXBT Tracks $3.7M BTC Theft From Bitcoin ATM Firm to KuCoin

April 2026 — Fake Ledger Live app theft
A fake Ledger app resulted in about $9.5 million being stolen from more than 50 victims. ZachXBT said the funds were routed through more than 150 KuCoin deposit addresses tied to AudiA6.
Fake Ledger Live app theft

June 2026 — Secret Network / Axelar bridge exploit
About $4.67 million was stolen and the ETH was split into roughly 30 transfers before reaching deposit addresses at KuCoin, ChangeNow and HitBTC.
Axelar bridge exploit

July 2026 — Private-key compromise thefts
After withdrawing about 3,200 ETH, the attacker laundered approximately $5.5 million through Circle CCTP and transferred the resulting funds to seven KuCoin deposit addresses on Arbitrum.
Investigations by ZachXBT

September 2026 — FomoPeek malicious iOS app
About $580,000 in crypto was stolen, with portions of the funds traced to KuCoin, FixedFloat and cce.cash.
FomoPeek malicious iOS app

There are around 5 to 6 cases reported in 2025 too where KuCoin was used, so it's really not a big deal. What's so surprising to me is that Near Intent just blocked $50M of these hackers in an attempt to launder them, and those hackers took it so seriously that they found the loophole in just three days. Haha, that's crazy.

But I also want to add a line for other readers that it does not mean hackers will go easy on those platforms that will let the funds go through. Bybit hackers used THORChain to launder the majority of the funds, while in 2026, a few months ago, THORChain also lost around $11 million in a hack. So, this is just a way for these hackers to bypass any platform they want. They seem unstoppable.

[RGBTC]

Maybe they are very confident that they used fake information to perform KYC verification, but I don't see how Kucoin can not flag such a transaction as suspicious way before they even trade or withdraw the funds.

That seems to be the case, and I suspect the hacker still has a few other fake accounts in reserve. What allowed these transactions via the centralized exchange to proceed smoothly was that:

• the hacker possessed verified accounts;
• KuCoin likely viewed the funds as coming from a known source; and
• the operation was executed very quickly, judging by the sequence of events, the hacker had already completed the bridging on KuCoin (starting September 30) before the media frenzy regarding the hack erupted the following day.

[Darker45]

~snip~

That seems to be the case, and I suspect the hacker still has a few other fake accounts in reserve. What allowed these transactions via the centralized exchange to proceed smoothly was that:

• the hacker possessed verified accounts;
• KuCoin likely viewed the funds as coming from a known source; and
• the operation was executed very quickly, judging by the sequence of events, the hacker had already completed the bridging on KuCoin (starting September 30) before the media frenzy regarding the hack erupted the following day.

This may be the case, but with the data provided above by Faisal2202, KuCoin is indeed a curious case. This year, this is at least the 6^th time proceeds from a theft are deposited on the exchange. Last year, it's more or less the same number of times. Why do thieves seem confident to bring their stolen funds to KuCoin?

Anyhow, for the n^th time, KYC is proven useless. I wonder if exchanges would one day implement something similar to the 1x wagering requirement by casinos to combat money laundering.

[joniboini]

Why do thieves seem confident to bring their stolen funds to KuCoin?

If they do use bought accounts/KYC, I can imagine that KuCoin is slow on taking down these fake accounts compared to other exchanges, or that the number of accounts they can use is larger compared to other platforms. Things will be very messy if they stole accounts from legitimate users though. I can't imagine the stress because some scammers use your ID. Not like it's the first time something like this happened anyway. What they need to do is improve their security if they really put customer interest first tbh, but we know that's probably not the case.

[NotATether]

According to the article, the security vulnerability involves the BNB Chain (BSC). What is striking is that BSC is considered centralized and KuCoin is a platform that requires KYC; even the NEAR Intents protocol froze transactions linked to funds stolen in the Bitget hack^[1]. Yet, despite all this centralized infrastructure, these protocols fail to secure deposits.

[1] https://thedefiant.io/news/hacks/near-intents-says-it-froze-503-000-in-bitget-hack-funds

Yes but you see, they have no problem blaming the privacy community for their own operational failures, so why don't they just blame the Bitcoin bridge involved 🤡🤡🤡

Seriously, I don't get why they don't even bother to secure their infrastructure. If this was a server exploit, as opposed to a smart contract exploit (which is still inexcusable), this is indefensible. I am spending hundreds of dollars worth of tokens right now to sandbox my server, and if I can do it, certainly these billion-dollar companies can too.

[RGBTC]

Why do thieves seem confident to bring their stolen funds to KuCoin?

I think they already knew it was an easy route for them, based on past events. It is not a matter of confident; the hackers have absolutely no concerns. They face no risk of their true identities being exposed, and it isn't their own money.

We will likely see them implement stricter withdrawal policies for example, requiring manual review for amounts exceeding $100k. hahaa

[NotATether]

We will likely see them implement stricter withdrawal policies for example, requiring manual review for amounts exceeding $100k $100. hahaa

Fixed that for you.

I wouldn't be surprised if these exchanges decided to hold even ridiculously small amounts under manual review so that they can cover their bases for having such awful AML protection.

They already cockblock you with KYC before you can deposit anyway, so why not slap a source of funds check for tiny amounts too 

[hugeblack]

This is not the first time. I have mentioned KuCoin several times on several occasions, that hackers have been using KuCoin since 2021. Like, I can prepare a list for you to cover almost all of them, but some of them will be:

Imagine if this behavior were carried out by a NoKYC service. We've all heard about the importance of KYC and how it reduces fraud.

That seems to be the case, and I suspect the hacker still has a few other fake accounts in reserve. What allowed these transactions via the centralized exchange to proceed smoothly was that:

I don't think so. It's unusual for over $20,000 in deposits to pass through an account without a flag being activated that requests further information from the user. And assuming the platform allows such deposits, withdrawing over $100,000 without requesting further verification is extremely strange.

[NotATether]

This is not the first time. I have mentioned KuCoin several times on several occasions, that hackers have been using KuCoin since 2021. Like, I can prepare a list for you to cover almost all of them, but some of them will be:

Imagine if this behavior were carried out by a NoKYC service. We've all heard about the importance of KYC and how it reduces fraud.

They already closed down eXch for this.

It was wrong to close them, obviously, but the pressure from big exchanges to claw losses "back" from the small ones is unreal.

That seems to be the case, and I suspect the hacker still has a few other fake accounts in reserve. What allowed these transactions via the centralized exchange to proceed smoothly was that:

I don't think so. It's unusual for over $20,000 in deposits to pass through an account without a flag being activated that requests further information from the user. And assuming the platform allows such deposits, withdrawing over $100,000 without requesting further verification is extremely strange.

There are many poor people in the world, it's not too difficult for hackers to purchase their KYC from them for like $1000 or something and build an army of fake personas like that.

[Taskford]

That seems to be the case, and I suspect the hacker still has a few other fake accounts in reserve. What allowed these transactions via the centralized exchange to proceed smoothly was that:

I don't think so. It's unusual for over $20,000 in deposits to pass through an account without a flag being activated that requests further information from the user. And assuming the platform allows such deposits, withdrawing over $100,000 without requesting further verification is extremely strange.

There are many poor people in the world, it's not too difficult for hackers to purchase their KYC from them for like $1000 or something and build an army of fake personas like that.

Look at this there's a site points out on which people could buy Kucoin verified accounts https://www.slideshare.net/slideshow/top-7-site-to-buy-verified-kucoin-accounts-fully-verified-active-accounts/289274275#google_vignette

Also I'm surprised that they even reach on daily motion posting this type of services https://www.dailymotion.com/video/xbdukvu

So its not surprising to see that their site is been widely used for such act. Because there are sites or people like them sold verified accounts.

Kucoin should act on this, because if more incident like this will happen. Maybe they might face another legal consequences with this situation.

[NotATether]

Kucoin should act on this, because if more incident like this will happen. Maybe they might face another legal consequences with this situation.

There are many such places where you can buy KYC verified accounts - they are embarrassingly easy to obtain.

Especially for KuCoin I think they're in big trouble if they don't crack down on this - you're right about that.

[LuckyCrypto777]

Community Alert: Near Intents was exploited for $3.8M+ after its BSC hot wallet saw multiple irregular outflows a few hours ago.

Near Intents hot wallet 0x233c has since stopped processing transactions and the site status  (https://partners.near-intents.org/shield/status) shows an ongoing incident impacting multiple EVM chains.

The funds were immediately transferred to Kucoin and bridged to Bitcoin.

BSC theft address
0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37

Source

https://t.me/investigations/365

https://x.com/near_intents/status/2105642219357241796

Oh my  
Alex's words were not unfounded, and the hacker decided not to wait 48 hours, but returned everything stolen.


https://x.com/AlexAuroraDev/status/2106049685928677585

I wish all the hacks that happened were solved this way.

[Faisal2202]

Imagine if this behavior were carried out by a NoKYC service. We've all heard about the importance of KYC and how it reduces fraud.

No KYC platforms have definitely been used more times than KuCoin, and hackers moved funds through no KYC platforms more than KuCoin, but the report that DOJ shared back in 2024 says KuCoin has almost received $5B and sent over $4B in suspicious and criminal proceeds because their KYC was easier to pass. They also pleaded guilty in 2025, and were fined $297M, and they have agreed to leave the US market for two years. Same like Binance, but Binance did not get that time window. So these KYC platforms are given some relief, don't know why? But I know for a fact convenience never comes free.

They already closed down eXch for this.

It was wrong to close them, obviously, but the pressure from big exchanges to claw losses "back" from the small ones is unreal.

But authorities also seized around 8 TB of data from them. BTW they closed many, not just eXch. As I was saying to Huge above, why do they do that, the same amount of money was moved from the KYC platform and maybe less from this no KYC, then why is KYC just facing 2 years ban in the US and a $297M fine while this one was shut down! 

[Zwei]

There are many poor people in the world, it's not too difficult for hackers to purchase their KYC from them for like $1000 or something and build an army of fake personas like that.

not even $1000, you can buy full KYC for as low as $100 on some places (which i won't mention), i would imagine you could get a discounted price if you buy in bulk.

Oh my 
Alex's words were not unfounded, and the hacker decided not to wait 48 hours, but returned everything stolen.


https://x.com/AlexAuroraDev/status/2106049685928677585

I wish all the hacks that happened were solved this way.

how nice of him, lol. he probably fucked up trying to launder the coins and exposed himself somehow, got cold feet and decided it was not worth it.

[salad daging]

I wonder if exchanges would one day implement something similar to the 1x wagering requirement by casinos to combat money laundering.

It could be that the exchange in the future will apply strict rules, with the 1x requirement it is easy for them, just trade back and forth BTC to USDT to USDC it already meets the 1x requirement.

We will likely see them implement stricter withdrawal policies for example, requiring manual review for amounts exceeding $100k. hahaa

Isn't an exchange with a withdrawal above $100,000 required to pass KYC level 3?
KYC 1-basic information.
KYC 2-identity document
KYC 3-information about the source of funds and bills of the previous 6 months.

I do not know if the hackers have already gone through that with their Kucoin accounts? If suppose the Kucoin account that is bought normally has passed all of it, because in any black market there is what we need.

[OmegaStarScream]

Isn't an exchange with a withdrawal above $100,000 required to pass KYC level 3?
KYC 1-basic information.
KYC 2-identity document
KYC 3-information about the source of funds and bills of the previous 6 months.

I do not know if the hackers have already gone through that with their Kucoin accounts? If suppose the Kucoin account that is bought normally has passed all of it, because in any black market there is what we need.

I don't believe that's a thing? At least I have never heard of someone mentioning that regarding most major exchanges. An ID or passport seem to be more than enough to give you plenty of limits, until of course... they detect a "suspicious activity" then that's where the source of funds questions start to araise.

[JeromeTash]

Anyhow, for the n^th time, KYC is proven useless.

The KYC verification for exchanges is still so relaxed unlike casino. Most of the crypto exchanges I have used to move thousands of funds have never asked me for anything beyond level 2 verification (national ID and liveness check)

I wonder if exchanges would one day implement something similar to the 1x wagering requirement by casinos to combat money laundering.

Money laundering is still pretty easy to pull of in a exchange even if you had to force the traders to at least make 1x trade. What would make it header is proof of source of funds for every incoming transaction before the account is credited.