NEAR’s new US ETF is facing its first stress test days after launch as a $3.8 million ecosystem exploit hit the token.
NEAR fell about 10% to $4.86 after NEAR Intents disclosed a security incident involving its Omni deposit-and-withdrawal infrastructure. The selloff came less than two days after Bitwise opened the token to US exchange-traded fund investors through its NEAR ETF, with the ticker NRR.
The fund began trading on NYSE Arca on Sept. 29 and attracted $35.5 million of net inflows on its first day. By Sept. 30, cumulative inflows had risen to over $50 million, while total net assets reached $52.8 million, equivalent to about 0.76% of NEAR’s market capitalization, according to SoSoValue data.
That timing gives the newly launched product an unusually early test of investor conviction. The ETF protects buyers from the operational burden of wallets, private keys, and direct staking, but its value still moves with NEAR, leaving shareholders exposed when problems elsewhere in the ecosystem undermine confidence in the token.
A $3.8 million exploit hits NEAR Intents
In an X statement, NEAR Intents said it temporarily halted services after detecting what it described as a bug in the interaction between its Omni infrastructure and the Intents smart contract.
The preliminary loss was about $3.8 million, and the project said it would fully compensate affected users. The team patched the contract vulnerability, and NEAR Intents and near.com resumed operations after a temporary suspension.
Some deposit and withdrawal routes remained unavailable for longer while the team completed fixes to Omni infrastructure covering networks including BSC, Polygon, TON, Optimism, Avalanche, Stellar and Scroll.
NEAR co-founder Illia Polosukhin said the exploit was isolated to USDT on BSC and that NEAR Intents’ SHIELD security system detected unusual activity before pausing services. He said the team identified and fixed the vulnerability within an hour.
The base NEAR blockchain continued operating throughout the incident. NEAR Protocol said the exploit did not involve a vulnerability in the network or the native NEAR token, and that block production and transaction processing continued without interruption.
That separation limits the direct operational impact on Bitwise’s ETF, which holds exposure to NEAR rather than assets deposited through NEAR Intents. The market reaction nevertheless shows how quickly application-level failures can feed through to an asset newly packaged for traditional investors.
The Intents business is also large enough to make the incident more than a peripheral ecosystem problem. Polosukhin said the service now processes more than $4 billion a month in trading and payments volume, positioning it as one of NEAR’s major connections to other chains and applications.
The team has reported the incident to law enforcement and is working with blockchain analytics and security firms to trace the stolen funds. A fuller postmortem is expected in the coming days.
Polosukhin said the ecosystem plans to expand its use of formal verification and other security tools after the breach, including work already underway on a verification system for NEAR smart contracts.
He stated:
“The crypto space is entering a new era of far more sophisticated cyber attacks. Recently, we have seen BitGet, Metamask, Lido all being targeted by criminals equipped with AI systems that are continuously trying to hack all infrastructure. As a space, we need to be far more vigilant and raise the bar on both onchain contract standards and offchain monitoring and proactive prevention.”
The ETF arrived after leverage had already started leaving
The price decline also landed in a market whose speculative positioning had already changed substantially before NRR began trading.
Blockchain analysis firm Santiment said NEAR-denominated futures open interest peaked at roughly 215 million NEAR on Sept. 21, eight days before the ETF launch. By Sept. 29, that figure had dropped about 21% to 169 million NEAR, even as the token’s price had risen roughly 86% from Sept. 16.
Dollar-denominated open interest continued climbing for several days, reaching about $1 billion on Sept. 27, but the declining number of NEAR committed to derivatives suggested leverage was already thinning before the ETF opened.
That makes the post-exploit move different from a straightforward leveraged unwind. Spot demand had strengthened into the launch while speculative positioning was being reduced, according to Santiment, giving the ETF inflows a more prominent role in the market structure.
NRR’s first two days showed that institutional demand was present, but the harder test begins after the breach.
If inflows continue despite the 10% drop, investors would be signaling that they are willing to separate an application-specific exploit from the investment case for the underlying network. A reversal in flows would show how quickly an ecosystem security event can interrupt demand for an ETF that has existed for only a handful of trading sessions.
