The attackers used a zero-day vulnerability in a third-party security product to steal internal credentials and spoof fraudulent withdrawals, Chen said. The group ran test transfers below risk thresholds 30 minutes before draining hot wallets, though private keys and cold wallets were not compromised. While the exchange experienced $463M in net outflows after resuming Bitcoin transfers on September 28, NEAR Intents’ SHIELD system later blocked over $50M in attempts to move stolen funds.
