NEAR Intents / HOT Bridge: What the recovery follow-up establishes

18 October 2026

The 16–17 October disclosures revisit the NEAR Intents / HOT Bridge incident reported for 29 September–1 October 2026. They add postmortem and recovery context to an earlier exploit. The central questions are how bridge backing and internal credit became separated, what the BNB Chain record supports, and what evidence establishes the reported return.

SentinelTX’s 25-page report, CASE-ASYNCE30, distinguishes three transfer-anchored payouts totaling 3,500,000 BSC-USD from two further calls in its narrative. Its routing appendix gives those two calls a different classification. That qualification matters as much as the headline number. This article summarizes the native report; its claims have not been independently re-verified here.

What changed in the October follow-up

The report’s chronology attributes the 16–17 October coverage to a deposit-notification bug, “ghost balances,” a reported full recovery, and changes including feature removal and an automatic pause. The feature-removal statement comes from a Defiprime search snippet; the report says that page was not an admissible fetch source. These remain attributed reports, rather than a fresh implementation review.

Earlier coverage cited in the PDF places the reported return around 3 October. The later postmortem therefore updates the explanation and safeguards. It does not supply a hash-anchored recovery transaction within this report. [PDF pp. 3, 8, 14–15]

Three payouts, two further calls, and a classification gap

The executive summary and conclusion classify these treasury-to-recipient transfers as confirmed:

• 800,000 BSC-USD: 30 September 2026, 23:54:30 UTC; block 125,000,023. Transaction
• 1,200,000 BSC-USD: 1 October 2026, 00:24:02 UTC in the routing appendix; block 125,003,957. Transaction
• 1,500,000 BSC-USD: 1 October 2026, 00:50:42 UTC in the routing appendix; block 125,007,511. Transaction

Narrative-confirmed total: 3,500,000 BSC-USD.

Two additional recipient-signed treasury calls contain calldata words equal to 330,000 × 10^18 and 35,000 × 10^18. The narrative classifies them as partial: transaction objects were examined, but the cited transfer legs were missing. It attributes the corresponding 330,000 USDT and 35,000 USDT payouts, and the 3,865,000 USDT total, to CertiK.

Source qualification: page 16 also lists those same two hashes as “verified” treasury-to-recipient BSC-USD movements, with transfer amounts of 330,000 and 35,000. Page 19 says the routing table lists movements of value. This differs materially from the partial classification on pages 3 and 14. The report does not reconcile the classifications. We retain the narrative’s three-payout total while making the appendix’s additional evidence explicit.

Figure 1. The narrative’s three confirmed payouts total 3,500,000 BSC-USD. Its two partial calls correspond to a further 365,000 in CertiK’s reported USDT total; page 16 separately labels both as verified BSC-USD movements. These classifications remain unreconciled. Sources: PDF pp. 3, 14–16, 19.

Address key

Treasury role, attributed to CertiK: 0x233c5370CCfb3cD7409d9A3fb98ab94dE94Cb4Cd

Recipient: 0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37

BSC-USD token contract in the report: 0x55d398326f99059ff775485246999027b3197955

The treasury and recipient returned no attribution-database label in this investigation. Their incident roles derive from CertiK’s public account. BSC-USD quantities are preserved as recorded; public-source USDT and dollar figures are not silently substituted for them. [PDF pp. 3–4, 7]

How the reported accounting failure worked

The PDF attributes the NEAR-side explanation to CertiK. A refund calculation was bounded by the receiver’s existing balance but not by the current deposit. An oversized burn event then exceeded the log limit, the resolver failed, HOT returned the deposited backing, and the earlier Intents credit survived. This describes the separation between returned backing and surviving internal credit that underlies the reported “ghost balance” mechanism.

The report names intents.near and v2_1.omni.hot.tg, and attributes the first exploit transaction to 29 September 2026 at 16:14:19.280 UTC. Native NEAR tracing was unsupported and refused before querying that chain. These details remain public-source context, not native NEAR findings.

One numerical conflict must stay visible: page 3 gives a 16,495-byte event and a 16,384-byte limit, a difference of 111 bytes. Page 11 instead describes an 11-byte overflow. This article does not select a corrected figure.

Figure 2. Reported mechanism: resolver failure leaves Intents credit in place while HOT returns backing. This NEAR-side sequence is attributed to CertiK, not natively traced by SentinelTX. The report’s 111-versus-11-byte discrepancy remains unresolved. Sources: PDF pp. 3, 11, 22.

On BNB Chain, the examined payout transaction objects show the recipient submitting calls to the treasury. That transaction-sender direction differs from the token-transfer direction: the calls travel toward the treasury, while the payouts travel toward the recipient. The report did not decode the withdrawal selector or establish the signer of the trailing authorization-like blob. [PDF pp. 3, 10]

What the movement record shows

At 23:57:38 UTC on 30 September, a recorded swap sends 100,000 BSC-USD through the MetaMask Swap Router and returns 128.865999 BNB. Fourteen seconds later, the narrative records another 128.75691 BNB inflow. Although that narrative citation omits the input leg, page 16 supplies a further 100,000 BSC-USD input for the second transaction. This is additional appendix detail, not evidence that the narrative’s narrower citation was a complete flow account.

At 01:25:39 UTC on 1 October, the report records 350 BNB entering CoW Protocol EthFlow. A subsequent WBNB-contract hop is described, but its own transaction hash is not cited. A token-contract destination does not identify a custodial exchange deposit; the eventual order settlement remains unresolved.

The narrative also identifies direct relationships with three downstream wallets. Pages 17–18 add direction and amounts for selected movements beyond the narrative’s narrower citations. Those rows do not, by themselves, complete every route or establish a return.

Similarly, the KuCoin-labelled leg is partial in the narrative. Page 18 identifies a depositor, 0xcd87c2e1f53b7df97f1db56aec6c63cbd60bb262, and a 99.999959 BNB recorded amount. Its relationship to exploit proceeds still lacks the complete amount-anchored path described as missing in the narrative. The earlier Binance-labelled treasury transfers occurred on 29 August and are excluded from incident attribution. No cross-chain route was established. [PDF pp. 7–11, 16–19]

Why reported recovery remains a separate claim

Several outlets cited by SentinelTX report a full return of approximately $3.8 million. The report does not identify a hash-anchored return from the recipient or downstream wallets to the treasury or a designated HOT/NEAR recovery address.

An 18 October token-balance query returned no token holdings for the recipient. That cannot establish where the assets went or prove repayment. Nor should it be read as a comprehensive finding of zero assets across chains.

Collection limits matter too. Two executed query windows span 29 August–18 October, but the 3,397 retained movements run only from 29 August to 2 October. The appendix records page caps, unwalked rows and a provider page that did not answer. It also states that enforcement of a requested historical window or block cutoff was not established. A query end date is not proof of complete coverage through that date, and this record cannot establish that no later return occurred. [PDF pp. 4, 20–22]

Figure 3. Recovery is reported, with no return transfer hash-anchored in the report. The payout classifications, NEAR-side validation and complete downstream routes still require reconciliation. Sources: PDF pp. 13–16, 20–22.

What would close the evidence gaps

The report’s priorities are concrete: obtain return hashes, receiving addresses and per-asset amounts; reconcile the two payout classifications; resolve the CoW order’s settlement; and complete the downstream paths with a NEAR-capable source where needed.

The follow-up provides a useful accounting-failure explanation and a detailed BNB Chain record. A defensible conclusion preserves the boundary between reported recovery, transaction evidence and unresolved source differences. That boundary is essential to understanding what this postmortem actually establishes.

Source note: SentinelTX, CASE-ASYNCE30, compiled 18 October 2026, 25 pages. Explorer links use exact BNB Chain transaction hashes printed in the PDF and are supplied for reference; they do not represent a separate verification pass. The PDF and detached verification manifest document the compiled artifact’s provenance. They do not resolve the substantive qualifications described above.