On October 1, [NEAR Intents](https://www.near.org/intents) — a service for swapping assets across blockchains halted everything. A bug in the interaction between its Omni deposit and withdrawal infrastructure and its smart contract had been drained for roughly $3.8 million. The on-chain investigator ZachXBT traced the funds to KuCoin and onward into Bitcoin within hours. Then came the part almost nobody expected. NEAR's team identified the attacker in under 24 hours, issued a public 48-hour ultimatum framed as "responsible disclosure" and on October 2, the full sum came back, including roughly 34.6 BTC. Investigation closed. It's a remarkable outcome. It is also a distraction from the more important question: Why did the money have to be recovered at all? Why do bridges keep getting robbed — and why will the next one be robbed too? Because a crypto bridge is a honeypot by design. Not by accident, not by negligence — by design. Its important to make a distinction here: The hack occurred on Near Intents, and not the Near Blockchain. Near Intent is a service built on top of the near blockchain. --- ## What a Crypto bridge actually is Blockchains can't talk to each other. Ethereum doesn't know what happens on BNB Chain, and neither knows about Solana. A bridge is the workaround: it locks your coins in a vault on one chain and issues you a matching IOU on the other. The bridge must hold large pools of real user funds to function. Every bridge, on every chain it serves, sits on a vault. To move assets across chains at any scale, those vaults must be deep. There is no version of this design where the money isn't sitting there. ### Maximum reward, maximum attack surface Now put yourself in an attacker's position and compare targets. A wallet holds one person's money. An exchange holds many people's money but sits behind a company's security team, withdrawal limits, and law enforcement relationships. A bridge holds many people's money in a smart contract — ***code that anyone on earth can read, probe, and attack, 24 hours a day, with no permission required and no one to call.*** That combination of pooled funds plus publicly auditable code plus cross-chain verification logic, which is among the most complex code in crypto — is what makes bridges the single most-attacked infrastructure in the industry. According to [Chainalysis](https://cryptonakta.com/crypto-bridge-hacks/), roughly $2 billion was stolen from bridges across 13 separate hacks in 2022 alone — about 69% of all crypto stolen that year. The numbers since haven't broken the pattern, only continued it. This isn't a streak of bad luck. It's economics. *Where the money pools, the hunters gather*. --- ## The graveyard The names change; the design doesn't. Here are the largest cross-chain bridge hacks recorded according to research by cryptonakta.com:  Eight incidents, well over $2.5 billion, five years — and the root causes rotate through every failure class there is: ***bugs, phishing, bad configuration, centralized custody, compromised infrastructure.*** When every type of failure finds the same target, the target is the problem. ## Why it keeps happening If bridges are this dangerous, why do they exist at all? Because demand is real. People hold assets on one chain and want to use applications on another, and the alternative — selling everything, withdrawing, rebuying is slow and expensive. So the market built the workaround, and the workaround needs deep vaults to be useful, and deep vaults are bounties. Notice the trap: a bridge gets **safer to use** as it gets **more dangerous to exist**. More liquidity means faster, cheaper swaps for you — and a bigger prize for attackers. Every dollar of convenience is a dollar of bounty. There is no engineering fix for this tension; there are only mitigations around the edges (better audits, bug bounties, smaller validator sets replaced by larger ones, insurance funds). The core geometry of pooled money and public code doesn't change. The NEAR incident is the latest proof, not an exception. The bug was in the **interaction** between two systems exactly the kind that cross-chain complexity creates and audits miss. --- ## **What the recovery proves and what it doesn't** Give NEAR credit: identifying an attacker in under 24 hours and recovering everything is an exceptional security response. But read it carefully, because the wrong lesson is tempting. The recovery proves that fast forensics plus a credible threat can work. It does not prove that hacks get reversed. Full recoveries are extraordinarily rare, the graveyard above tells you how many users were made whole by the attacker returning funds versus by someone else paying for the loss (Jump Crypto covering Wormhole, Sky Mavis covering Ronin). Most of the time, the money is simply gone, laundered through the same cross-chain infrastructure that was attacked. If your safety plan for bridges is *"they'll probably get it back," you don't have a safety plan.* ### What this means for you You don't need to understand cross-chain message verification to protect yourself. You need one mental model: ***a bridge is a middleman holding your coins, and middlemen get robbed.*** Act accordingly: 1. **Get in, swap, get out.** A bridge is a crossing, not a parking lot. Never leave funds sitting in bridge contracts longer than the transaction requires. 2. **Prefer native assets**. If you can hold the real asset on its native chain instead of a wrapped IOU that depends on a bridge vault, do that. 3. **Size it like the risk it is**. Whatever you route through a bridge should be an amount whose total loss you can survive — because total loss is a historically normal outcome. 4. **Watch the seams**. Upgrades, new chains added, "v2" launches — the NEAR bug lived in an interaction between systems. New complexity is new risk. None of this requires trusting any company's promises. It's all downstream of the design. --- Every bridge hack is the same story wearing a different date: money pools by design, code is public by design, and attackers are rational. The market keeps rebuilding the honeypot because the demand is real — and keeps getting robbed because the geometry is fixed. You can't redesign the bridge. You can decide how long your money stands inside it. Before you click "bridge," pause and ask the only question that matters: ***am I crossing, or am I parking?*** One of those is a transaction. The other is a donation to whoever finds the next bug first. This is exactly what **[Day 3 of the Free Safety Kit](https://cryptostoicmedia.com/)** covers — the custody playbook: how to keep your coins under your own control instead of parked in someone else's vault. [](https://cryptostoicmedia.com/)