News linked to both this project and an event.
According to CoinDesk, the development team behind Zcash's new node software, Zakura, plans to generate a unique viewing key for each ZEC swap conducted via NEAR Intents, while the spending key remains secured by the user's primary account. Under the current architecture, when users swap private ZEC for USDC via NEAR Intents, one of their Zcash privacy addresses is publicly broadcast on the NEAR public chain as a refund address and remains retained after the swap is completed. While this address currently does not leak information, sufficiently powerful quantum computers in the future could potentially reverse-engineer the viewing key using Shor's algorithm, thereby linking all payments received by that account, including amounts and memos. By implementing a "one-key-per-swap" approach, even if a refund address is compromised, attackers will only be able to view payments related to that specific swap. To address the issue of having to scan the entire blockchain sequentially during wallet recovery due to an abundance of keys, Zakura employs Private Information Retrieval (PIR) technology, allowing the wallet to query the location of incoming refunds without the database learning which address was queried.
In a postmortem article published by Alex Shevchenko (@AlexAuroraDev), lead of NEAR Intents, a vulnerability was identified in the NEAR Intents contract's deposit notification mechanism when interacting with third-party contracts. The attacker deployed a contract that caused the notification call to fail, triggering the token contract to refund the deposits while the NEAR Intents contract retained the deposit records. Through 23 failed deposit transactions, the attacker generated approximately $3.8 million in "phantom funds," which were subsequently withdrawn to external chains via Omni infrastructure. This vulnerability resided in the NEAR Intents contract rather than in the Omni infrastructure. The timeline indicates the attack occurred between September 29 and October 1. The team detected withdrawal anomalies on October 1 and paused the contract within 29 minutes. Thanks to collaboration between the SHIELD security layer, on-chain tracking efforts, and industry security researchers, the attacker fully returned the funds on October 2, and all affected users have been compensated. The postmortem highlighted that existing monitoring only tracked discrepancies between aggregate token balances on the source chain versus NEAR, failing to monitor the mismatch between total user balances and contract token balances. This oversight allowed the attack to proceed undetected for several days. For remediation, the team has completely disabled the deposit notification functionality and implemented new monitoring for discrepancies between total user balances and contract balances. If this invariant is violated, the contract will automatically pause. On October 7, white hat research
NEAR Protocol announced that NEAR accounts now support the post-quantum ML-DSA signature scheme, enabling users to complete key upgrades without any asset migration. Meanwhile, the NEAR One team is advancing the NEP-655 proposal, which derives implicit accounts via an initial state hash, storing assets behind the hash so that no public keys or key hashes are exposed on-chain. It is currently live on the testnet and expected to launch on the mainnet within weeks. Additionally, the team is designing NEAR Intents Wallet Contracts that support custom signature extensions (including ML-DSA and hash-based schemes), and developing a NEAR-based Q-day recovery registry for external chains that have not yet deployed PQ keys, allowing users to submit recovery keys in a rotatable hash format. NEAR noted that its quantum-safe design philosophy was integrated into its architecture planning as early as 2018.
Illia Polosukhin stated that as on-chain tools expand, users no longer need centralized exchanges for many crypto activities. near.com integrates cross-chain spot trading, tokenized stocks, yield products, and perpetual contracts into a single interface, and plans to add more fiat-related features, including bank withdrawals, tax transaction records, and selective disclosure for confidential transactions. NEAR has partnered with Monerium to support users in converting between euros in bank accounts and EURe via IBAN, with the ultimate goal of enabling NEAR Intents to support "any asset to any asset" swaps. After integrating Ondo Finance in September, near.com already offers tokenized stocks and plans to add stocks from more global markets; NEAR's Agent Market allows users to describe their needs in natural language, with the platform finding agents capable of executing the task, and funds will be released after the task is completed and verified.
NEAR co-founder Illia Polosukhin posted that the recent increase in developer activity and further reduction in development barriers within the ecosystem center on what applications to build and how to establish distribution channels. In response, he proposed a series of potential building directions, including AI virtual pets combining NEAR AI’s on-chain verifiable inference with non-fungible tokens (NFTs); a universal checkout component supporting cross-chain intent payments; a decentralized encyclopedia integrating prediction markets with AI-generated content; a privacy-oriented OTC market based on NEAR Intents, alongside liquidation-resistant lending and perpetual contract management; a cross-chain event registration escrow tool backed by staking deposits; a privacy-preserving code review agent; a corporate cap table management tool; Delta-neutral strategy management; private copy trading utilizing view keys; an end-to-end encrypted medical auxiliary diagnostic system; a privacy-focused voice transcription desktop application; and AI benchmarking based on private test sets, among others.
Illia Polosukhin stated that the attack involving approximately $3.8 million only affected USDT on BSC. NEAR Intents and near.com are now back online, and affected users will receive full compensation.
Odaily News: According to monitoring by Bitget CEO, Bitget was hacked on September 24, with approximately $387.5 million in funds stolen, a large portion of which was transferred across chains and primarily consolidated on Ethereum. A report released by NEAR Intents shows that its risk intelligence layer SHIELD detected over $50 million in suspected money laundering transfer attempts; of this, $166,000 in funds went through, while $503,000 was frozen during execution. The frozen funds remain restricted pending subsequent legal and recovery proceedings.
Ondo Finance has announced its tokenized securities platform, Ondo Stocks, has launched on the NEAR mainnet and integrated with NEAR Intents. The initial rollout supports 20 tokenized U.S. stocks, ETFs, and commodity-related products, including shares of Tesla, Nvidia, Apple, as well as QQQ, gold, and silver ETFs. Eligible users can access these assets through the NEAR mainnet and distribute them to wallets and applications on connected networks via NEAR Intents. The NEAR mainnet supports access to over 30 blockchains. Ondo stated that its tokenized securities platform has surpassed $1 billion in total value locked, with cumulative trading volume exceeding $26 billion.