HOT Omni Bridge on NEAR Exploited: CertiKAlert Report

HOT Omni Bridge on NEAR was exploited on September 30, resulting in five BSC treasury payouts totaling $3.86 million, according to a CertiKAlert report published October 9. The exploited funds were subsequently returned, CertiKAlert noted, though the mechanics of the attack and the identity of the exploiter remain unconfirmed in the alert.

What the CertiKAlert Report Confirms About the HOT Omni Bridge Exploit

CertiKAlert, the on-chain security monitoring arm of blockchain auditor CertiK, flagged the incident under its #CertiKInsight classification. The alert identifies HOT Omni Bridge, a cross-chain bridge operating on the NEAR Protocol, as the exploited protocol. The five payouts were routed through BNB Smart Chain (BSC) treasury addresses, suggesting the attack vector involved the bridge’s cross-chain message or liquidity layer between NEAR and BSC. For related coverage, see Coinbase Spot Delists IDEX, LRC, OMNI, PIRATE and FIS.

The $3.86M figure represents the aggregate of the five observed BSC-side outflows. CertiKAlert stated the amount was later returned, which differentiates this incident from a typical irreversible bridge drain, though it does not resolve questions about whether the return was voluntary, coerced, or the result of on-chain recovery mechanisms. No transaction hashes or wallet addresses were included in the public alert. For related coverage, see MetaMask Agent Wallet Adds Aave MCP Support.

#CertiKInsight 🚨

On 30 Sept, HOT Omni Bridge on NEAR was exploited resulting in five observed BSC treasury payouts totaling $3.86M, which was later returned.

Read our full analysis here👇https://t.co/uoZWCkmpw1

CertiK Report Security Dashboard 👇https://t.co/Yqz3kRVoso

— CertiK Alert (@CertiKAlert) October 9, 2026

Source: @CertiKAlert on X

Risk Implications for NEAR Bridge Users

Bridge exploits carry outsized systemic risk in multi-chain DeFi because they sit at the trust boundary between two separate execution environments. When a bridge’s treasury is accessed without authorization, all assets locked on either side of the bridge face potential exposure until the vulnerability is patched and independently verified. The five-payout structure observed here suggests the attacker made multiple discrete withdrawals rather than a single atomic drain, a pattern that can indicate probing behavior or a rate-limited smart contract flaw. For related coverage, see Coinbase: U.S. Traders Access 80% of Crypto Derivatives Liquidity.

NEAR’s broader ecosystem has been expanding its cross-chain surface area; the protocol recently added post-quantum asset infrastructure across multiple chains, as covered in NEAR’s Quantus (QTC) launch. Each additional bridge or cross-chain primitive increases the attack surface that security monitoring services like CertiK must cover. Users who held assets on HOT Omni Bridge around September 30 should verify their current balance state and monitor for any official incident disclosure from the HOT Protocol or NEAR Foundation teams.

The return of funds does not confirm the bridge’s smart contracts are secure. In several historical bridge incidents, funds were returned after whitehats or negotiated disclosure, while the underlying vulnerability remained unpatched for days. Until a formal post-mortem is published by the bridge team or CertiK’s full analysis is released, the exploit’s root cause, the affected contract addresses, and the current security status of the bridge are all open questions.

What to Track as Verified Details Emerge

The CertiKAlert tweet links to a full CertiK analysis report. Readers should monitor that report for the specific vulnerability class (e.g., signature verification bypass, reentrancy, oracle manipulation), the confirmed transaction hashes on both the NEAR and BSC sides, and whether the bridge has been paused or patched. An official statement from the HOT Protocol team disclosing whether the return was negotiated or forced by on-chain governance would materially change the risk assessment.

Key unresolved questions include: whether HOT Omni Bridge remains operational, whether any user funds beyond the treasury payouts were at risk, and whether the five BSC treasury addresses involved have been publicly identified. Cross-chain bridge security is an ongoing concern across the DeFi stack, as highlighted by comparable incidents involving bridges connecting EVM and non-EVM chains. For parallel context on cross-chain infrastructure risk, the development of Chainlink CCIP vault adapters for one-click cross-chain deposits reflects the broader industry effort to standardize and harden bridge-layer security.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.