← Dashboard

Appendix: detail, method and the pre-registered event study

NEAR HACKATHON 2026 · Investment Thesis track · data snapshot to 2026-11-09 · every number below is generated by src/build.py from data/raw/ · this is the appendix to THESIS.md.

The thesis is written to be read in a few minutes. Everything it leaves out is here.

• Part B, the detail behind the thesis. B1 the rating in full; B2 what is at stake and the tripwires; B3 to B5 the full tables and caveats for Parts 1 to 4; B6 the evidence against, in full; B7 every deviation from the pre-registration.
• Part A, the pre-registered event study. The study this repository began as: five hypotheses about the freeze and the exploit, with rules written before the daily series were downloaded. Its primary result is an underpowered null, so it supports Part 1 rather than leading it. Sections A1 to A5 were planned; A6 and A7 are exploratory.

Part B. The detail behind the thesis

B1. The rating in full: five questions, what the price assumes, and the rule

Rating: Hold. Hold means keep NEAR you own and do not add yet. Horizon: the end of 2029, by when what reaches NEAR would have to cover issuance for holders to stop being diluted. First review: 31 March 2027, when the five calls in RATING.md are scored.

What the price assumes, to the end of 2029. NEAR trades at 213× annualised Intents revenue. The table is arithmetic, not a forecast: the change in NEAR's price if Intents revenue grows at the stated rate and the market pays the stated share of today's multiple, with supply growing at HSP-029's target rate.

• The losses are where growth stops, or where the multiple falls to a quarter. They are why this is not a Buy at 213×: the holder is paid only if revenue keeps compounding, and the one measure of it that is public and in NEAR terms has been uneven.
• The gain cells need the multiple to survive the growth. I put no probabilities on the cells; I do not have a basis for them.
• A holder's share of supply by the end of 2029, before any of the above. Not staked: -7.4% at today's issuance, -4.9% at HSP-029's target. Staked, before the validator's fee and using the gross yields in HSP-029's own model (4.8% now, 3.1% at the target): +7.3% and +4.6%. 57% of supply is not staked, by the same proposal. So Hold means hold staked.

The rule (RATING.md, timestamped; computed in src/build.py):

• The rule so far. No three months have reached 25%; the highest average is 17.8%, so the rule has given Hold throughout. The level was chosen after seeing these months, so this is a description, not a test. The test is the two calls in RATING.md.
• A Buy would still be at signers' discretion. The rule measures whether more reaches the wallets, not whether holders ever receive it. C1 in RATING.md is the guard: if the wallets shrink, the rating is Avoid whatever the inflow.
• Why that level. It is not a valuation: at 213× revenue no level of today's inflow makes NEAR cheap. It is the smallest move that would show the thing the price assumes, that what reaches NEAR can grow: 1.4× the last three months, held for a quarter, and above every three months so far.
• What Buy needs. Three months averaging about 21,700 NEAR a day at today's issuance, 1.4× the last three months' 15,486. The best single month so far was 18,814. RATING.md commits to two calls, scored on later data: the wallets keep the NEAR (C1), and the three-month average reaches 25% for a month between December and March (C2).
• Where today's inflow leads. Share of issuance covered at the end of 2029 if the NEAR inflow grows 0% a year: 16%; 25%: 31%; 50%: 56%; 100%: 138%. Arithmetic at today's issuance, not a forecast.
• What dilution costs. At today's issuance a holder who does not stake owns 7.4% less of the supply by the end of 2029. The wallets' inflow, if it stayed where it is and were never spent, would offset 16% of that. A holder who stakes receives the issuance instead of paying it, less the validator's fee (gross yield 4.8% in HSP-029's model; not measured here); for a staker the question is not dilution but whether Intents adds anything on top, and today the answer is the same 16%, held by signers.
• The issuance cut helps, and the rule ignores it on purpose. HSP-029 (House of Stake; status "Succeeded" on NEAR's governance forum) lowers NEAR's maximum issuance from 2.5% to 1.6% over 24 months. At the target rate the same wallet inflow would be 23.6% of issuance instead of 15.6%, and the growth needed to cover it 4.2× instead of 6.4×. That lowers dilution for holders who do not stake; the proposal's own model has gross staking yield falling from 4.8% to 3.1% for those who do. It says nothing about whether Intents sends more to NEAR, so the Buy level is fixed in NEAR a day. It takes effect only when validators run a release that includes it.
• Why not Buy. No collapse, but nothing is paid to holders, the NEAR reaching the wallets is 16% of dilution and sits at the discretion of a few signers, and at 213× revenue the price already assumes years of growth.
• Why not Avoid. The two interruptions most likely to end the growth, a freeze and an exploit, have happened once without a collapse; the apps that route the flow kept routing it; dollar revenue is at its highs; and the wallets have kept what they received.

Not in the rule, but reviewed if they happen (added 2026-11-11):

• Concentration. swapkit routes 37% of large-swap dollars. If its share of 1Click falls by half with no one replacing it, the flow has lost its largest customer.
• Visibility. NEAR Intents stops publishing 1Click swaps through its Explorer, or the Treasury account's balances fall while reported volume holds. Reported volume would then be uncheckable.

B2. What is at stake, and the tripwires

At 213× revenue, durability of today's flow cannot justify the price. The price needs Intents to keep growing. What this study adds is that the two most likely interruptions to that growth have now happened once, and neither caused a collapse.

Tripwires: when this thesis is wrong

Each is recomputed on every build, over the latest 28 days, with limits fixed by the calm period. The dashboard shows the same values. The order-flow and Zcash limits are the worst tenth of calm-period windows, so each breaks by chance in about one window in ten; the take-rate limit is the calm-period average. One broken tripwire is therefore not unusual, which is why the rule needs two. Applied to the 71 28-day windows of the calm period (overlapping; about 3 independent), at least one would have been broken in 30% of them and two or more in 6%.

• If order flow breaks, Intents is losing share to the venues it competes with, and the growth case fails.
• If the take rate breaks, Intents is buying volume with price, and revenue per dollar of flow falls.
• If Zcash stays broken, the privacy segment is leaving. It was 18.3% of balances on 2026-09-28, so watch whether the drain spreads to other assets.

B3. Detail for Part 1: the flow after a freeze and a hack

Two tests of users' trust arrived within three days of each other.

• Operator discretion (2026-09-29): SHIELD blocked more than $50M of transfers linked to the Bitget hack and froze $503k mid-swap, weeks after a Zcash user reported $589k held for 50 days.
• Security failure (2026-10-01): a $3.8M exploit paused the contract and halted deposits and withdrawals on eleven networks. The funds were returned on 2026-10-02, per the 16 October postmortem.

Both hit the thing that makes Intents revenue worth a multiple: users trusting it with funds. That makes the week a natural experiment on durability.

Who routes the flow: integrators and large swaps

Added after seeing results. Source: every successful 1Click swap of $10,000 or more from 2026-08-01 to 2026-11-09, 64,591 swaps, from the NEAR Intents Explorer API (src/fetch_explorer.py). The repository stores them as totals by day and integrating app (the swap's referral), and as counts of sender addresses that came back; no per-swap record or address is stored (see the note on API terms in the README).

• A few hundred swaps a day are the business. Swaps of $10,000 or more are about three-quarters of 1Click dollars in every period. Their volume was -1% against August in the 28 days from the freeze and -4% after the switch.
• Most integrators kept routing. 25 integrators routed $1M or more of large swaps in August. In the 28 days from the freeze, 23 still routed some, 17 kept at least half their August volume a day and 14 were at or above it; after the switch, 23, 16 and 12. Together they routed 83% of their August volume from the freeze and 84% after the switch (112% and 111% without new.intents-referral.near, below). In the three weeks before the freeze, 20 had kept half, so part of the thinning predates it.
• Which ones moved. Large-swap volume a day, by integrator:

The four after swapkit carried less in October than in August. Most of that is one label, new.intents-referral.near, whose volume had already gone in the three weeks before the freeze, while swaps naming no integrator rose. I cannot tell a relabelling from a loss. - The flow is concentrated. One integrator, swapkit, routes more than a third of large-swap dollars. That is a dependency a holder should know about: a routing decision at one company could move more volume than the freeze did. - Individual senders came back less. Of addresses that sent a large swap in the 28 days before the freeze, 8.4% sent another in the 28 days after (9,146 addresses). At the 4 start dates the data allows before the freeze (2026-08-29 to 2026-09-01), the rate was 10.2% to 10.9%. For addresses active on 5 or more days: 59% against 68% to 75% (94 addresses). This agrees with appendix A6, on a different population. - Limits. The calm comparison is one window: its 4 start dates overlap almost entirely, so there is no p-value, and its 28 days after include the September forum post. A sender is an origin-chain address; chains that use a new address per payment make people look new, and 21% of rows have no sender. An integrator is whatever the swap's referral field says.

The flow held and the apps that route it kept routing it, while fewer of the individual large senders came back. The customer that decides is the integrator.

What the pre-registered model adds

In one line: an underpowered null, and the estimate depends on the comparison venues. With the venues as pre-registered, reported volume was -24.3% against its model (p = 0.34; detection threshold -35.7%). With the narrower set I chose after seeing which venues had zero-volume days, it was +1.0% (p = 0.50; threshold -29.5%). Almost all of the difference is one venue, the 0x aggregator: without it the pre-registered set gives -8.2%. The pre-registered verdict is the same under both: no collapse, but too imprecise to clear the 25% bar. So the model cannot say whether Intents lost a quarter of its flow or none. The direct counts can say more: 1Click volume counted swap by swap (Part 2) and swaps of $10,000 or more (Part 1) were within a few percent of August.

What the freeze bears got right and wrong

• Not shown: the flow leaves. Counted directly, 1Click volume and large swaps were within a few percent of August (Parts 1 and 2). Against its model, DefiLlama's total gives -24.3% or +1.0% depending on the comparison venues, neither distinguishable from noise, and deposits were 12.2% lower from 27 October than in August. The pre-registered freeze-channel test (H4) found no Zcash flight in the month after the freeze.
• Missed: the public record leaves. The share of volume visible as public swaps fell from 43% to 13%, and from late October public swaps fell while executed intents doubled (appendix A7). Less of the flow can be seen.
• Partly right: public activity weakens. On public onchain volume the model gives -29.6%, weaker though not significant (p = 0.18). Accounts that had used Intents publicly before September came back less than in any calm period (appendix A6); they may have left or moved to a less visible route. Intents' summer momentum stopped (appendix A1). Zcash balances fell past their calm-period limit a month later.
• Shown: where the swaps went. From 27 October 1Click swaps settle confidentially (Part 2). Not shown: why NEAR Intents switched.
• Shown: who decides. 1Click's dollars come through a few integrating apps. 17 of the 25 integrators that routed $1M or more in August kept at least half that volume after the freeze, and together the 25 routed 83% of their August volume, while fewer individual large senders came back (Part 1). The bear case was about users; the routing decision sits with integrators.

B4. Detail for Part 2: the swaps left public view

On NEAR's chain the share of Intents volume visible as public swaps was 43% in the summer, 29% in the four weeks after the freeze and 13% from 2026-10-27 (appendix A7). The second step has a documented cause, traced below swap by swap. This part was added after seeing results; the switch date comes from NEAR Intents' changelog, not from this data.

NEAR Intents' changelog, 27 October 2026: "From October 27, 2026, 1Click swaps settle confidentially. The API is unchanged." The swap settles on FAR (the NEAR Private Shard), "a permissioned instance of the NEAR protocol operated by a small validator set with no public networking". Shielding moves tokens to the Treasury account 51e8f94d…7cbe on intents.near; unshielding releases them. The 1Click swap's nearTxHashes then hold "the hashes for the shield and the unshield instead" of the swap. The switch date used below comes from the changelog, not from this data.

Swap by swap. 300 successful 1Click swaps were drawn at random on each of five days from the NEAR Intents Explorer API (src/fetch_explorer.py) and followed through their NEAR transactions to what intents.near logged (sql/intents_swap_trace.sql, NEAR BigQuery). The days: one in August, one after the forum post, the days either side of 27 October, and one a week later.

Day by day (sql/intents_confidential_daily.sql): receipts executed by intents.near, and daily volume, averaged by period.

• The swaps did not disappear: every sampled swap is still executed by intents.near. What left the public chain is the swap itself, and with it the token_diff event that public dashboards count.
• The switch was rolled out, not flipped. No sampled 1Click swap touched the Treasury on 26 October; 6% did on 28 October and 87% by 5 November.
• Treasury flows began before the switch, but not from 1Click: apps could request confidential swaps from 1 July (the confidentiality quote field), and that use grew through September while no sampled 1Click swap used it. Neither upgrade (2026-10-02, 2026-10-07) moved the daily series.
• The sampled swaps were deposited from other chains or ordinary Intents balances, not from users' confidential balances: the change was in how 1Click settles, not users choosing privacy.
• 1Click volume in the 28 days after the freeze was -5% against August, and -5% after the switch: a second count of the flow, swap by swap. It is a different source from DefiLlama's, but the same operator's: the Explorer is NEAR Intents' own, and needs a partner token.
• Coverage: the Explorer series counts successful 1Click swaps of $100 or more, 98.8–99.5% of 1Click dollars on four days pulled in full. 1Click is part of Intents' volume, not all of it.
• What this cannot show. Why NEAR Intents switched, and whether it will publish the confidential volume elsewhere.

B5. Detail for Parts 3 and 4: what reaches NEAR, and who controls it

This thesis judges NEAR by what NEAR Intents sends back to it: cross-chain swap revenue that arrives as NEAR in three wallets, labelled a buyback since 23 February 2026. DefiLlama credits it to NEAR's holders, and it can be measured onchain. I do not test whether NEAR's price follows it; the claim is narrower, that a holder's case for years rests on that revenue lasting and growing.

• Growth so far. Volume first peaked at $3.66B in Nov 2025. It then sat between $1.90B and $2.78B a month for nine months, before a $4.80B record in Sep 2026. Oct 2026 was $3.99B: 2.3× the same month a year earlier, when Intents was still ramping up, but only 1.1× the first peak (Exhibit 6 on the dashboard).
• What reaches NEAR, measured. DefiLlama defines Intents revenue as NEAR swept into three wallets and labels it a buyback that is not burned (its adapter credits NEAR's own Dune query). Their balances on NEAR's BigQuery dataset (sql/revenue_wallets_daily.sql), on 2026-11-09: 2,229,710 NEAR in the buybacks wallet and the 1Click fund, and 1,994,812 in the front-end fund; 4,224,522 together, 0.32% of supply. Nothing is paid to holders, nothing is staked and nothing is burned: the NEAR sits in wallets whose signers can move it. The total fell on 2 of 367 days, by 49,577 NEAR in all.
• Against issuance. NEAR's total supply grew by 31.7M NEAR in the year to 2026-11-09 (2.5%), from NEAR's own supply table on BigQuery (issuance net of burns; circulating supply grew 36.5M including unlocks): 86,966 NEAR a day. In the 28 days to 2026-11-09 the three wallets gained 13,571 NEAR a day, 15.6% of that. 29% of the gain went to the front-end fund; the buybacks wallet and the 1Click fund alone gained 9,612 a day, 11.1%. The three-wallet gain matches DefiLlama's revenue for the same days, converted at each day's price, to 100.4%. To offset issuance the inflow has to grow about 6.4×.
• It is uneven, and price works against it. NEAR a day into the three wallets, by month (share of issuance in brackets): Mar 14,544 (17%), Apr 4,947 (6%), May 10,446 (12%), Jun 9,756 (11%), Jul 8,010 (9%), Aug 13,077 (15%), Sep 18,814 (22%), Oct 14,567 (17%). The last three months averaged 1.6× the first three; Oct 2026 was 2.9× the low of Apr 2026, 1.00× Mar 2026 and 0.77× the best month, Sep 2026. Which of those a reader calls the trend depends on the base month; what does not depend on it is that no month has passed 22%. Between Mar 2026 and Oct 2026, DefiLlama's revenue in dollars grew 3.9× and NEAR's price 3.8×, so the same NEAR arrived. That is the catch in a buyback: when the token rises, the same revenue offsets less issuance. Covering issuance by the end of 2029 needs the NEAR inflow to grow 81% a year; arithmetic, not a forecast: at +50% a year it takes 4.6 years, at +100% 2.7, at +200% 1.7.
• Who controls it. Read from the contracts (src/fetch_control.py): the buybacks wallet is a multisig that needs 2 of 4 keys; the 1Click fund is a DAO where 2 of 4 members approve a transfer; the front-end fund is a DAO where 2 of 5 do (auroracfo.near, aurorafinance1.near, aurorafinance2.near, aurorafinance3.near, paperclip-maximizer.near). Nothing in code commits the NEAR to holders. The front-end fund has a second, lower bar: a proposal to change its own policy (who the members are and how many must approve) passes with 1 vote from its 5 Admin members, who are the same accounts; in the 1Click fund that takes 2 of 4. So in the front-end fund the 2-vote rule on transfers holds only as long as no single member rewrites it. I read the thresholds from the contract; I did not test a policy change.
• How firm the target is. It moves with two things. NEAR keeps more of each swap now (4.9 bps of volume) than in the calm period (2.6 bps); at the calm share the target is 12.0×. A cheaper NEAR buys more tokens per dollar; at the calm-period price the target is 3.4×. Not established: which fees fund the wallets swap by swap, and what the signers will do with the NEAR.

Part 3 uses the same snapshot as the rest but was added after the pre-registration (deviation 5).

B6. Evidence against, in full

• The test is weak. A loss of 29.5% (35.7% with the pre-registered donors) would reach the detection threshold only about half the time, and anything smaller would usually look like this result. At today's run rate a 29.5% loss is $6.6M a year of revenue.
• The momentum stopped. Against the calm windows the onchain data covers, the event window ranks below all 44 (appendix A1).
• No outperformance. Raw comparisons with rival venues swing with the baseline (appendix A1). Against August, before the September rally, rivals grew more than Intents.
• The placebo distribution is coarse. The 155 pseudo-events start on consecutive days and their 28-day windows overlap, so together they carry about as much information as 6 independent windows.
• The estimate depends on the comparison venues. With the donors as pre-registered it is -24.3%; with my narrower set, +1.0%; synthetic control on the narrower set, +39.5%. The verdict is the same; the size is not known.
• The wider grid says the same. Across 60 alternative specifications (donor sets, controls, event date, horizon; not pre-registered) the estimate runs from -33% to +35%, median -4.1%, and 56.7% are negative. Every specification below −15% includes the 0x aggregator. 0x's mean daily volume in the event window was 8.4× its estimation-window mean, a launch curve rather than a market-wide factor, which is why I think it is a poor comparator. That argument is mine, made after seeing the results, so weigh it accordingly.
• September was a rally. NEAR averaged $3.53 in the three weeks before the shocks against $1.93 in the calm period. The spot-volume controls are meant to absorb this, and may not fully.
• Established accounts pulled back. Accounts that had used Intents before September came back less than in any calm period after the shocks (appendix A6). Large senders in the relayed 1Click flow show the same direction (Part 1), on one calm comparison.
• 1Click volume can no longer be checked on the public chain. Since 27 October the chain shows the shield and unshield of each 1Click swap, not the swap; the swap is visible only through NEAR Intents' own Explorer API, which needs a partner token. The verifiability that once set Intents apart now depends on its operator.
• The primary outcome is operator-reported. DefiLlama's Intents volume is read from a dataset NEAR publishes on Dune (dune.near.dataset_near_intents_metrics in DefiLlama's adapter), not from the chain. Counted from outside, public swaps with a stablecoin side were 45% of it in August and 33% from the forum post to the switch (the same measure as the visible share in Part 2, over different windows). After the switch (2026-10-28 on; appendix A7's 13% starts a day earlier) they are 12%, or about 33% with the 1Click swaps that now settle confidentially (Part 2). The rest I cannot count: swaps with no stablecoin side, and confidential flow outside 1Click. DefiLlama's figure is +44% on August while 1Click is -5%; I cannot say what the difference is made of. One reading fits the levels: before the switch DefiLlama's figure is 1.17× to 1.36× twice my one-sided count of public swaps, which is what a figure that counts both sides of each swap would look like. I cannot confirm that from the dataset's definition. If it is right, the public share before the switch was about twice what this document reports, and the fall is the same in proportion. The same pattern shows another way: in August, when nearly every 1Click swap was public, the public swaps I count ($40.5M a day) and the Explorer's 1Click volume ($38.7M) are close to each other and both under half of DefiLlama's $89.6M.
• 28 days is not the long term. It is what the calendar allows.

B7. Deviations from the pre-registration

1. Donors. The pre-registered rule drops a donor only for missing days in the estimation window. Applied literally it keeps thorchain-dex, chainflip-amm, maya-protocol, socket-protocol, jumper-bridge-aggregator, 0x-bridge-aggregator, rango and gives -24.3%. I narrowed it after looking at the series, before computing any outcome: I dropped donors with zero-volume days (THORChain and Maya; LI.FI has missing days and falls to the rule itself) and 0x, whose history does not cover the placebo windows. My stated reason for the zero-day drop, that a zero makes the log index undefined, was wrong: the index averages the donors before taking logs. The narrower set (chainflip-amm, socket-protocol, jumper-bridge-aggregator, rango) gives +1.0%. 0x's mean daily volume in the event window was 8.4× its estimation-window mean, a launch curve rather than a market-wide factor, which is why I still think it is a poor comparator; that argument was made after seeing the results. Appendix sections A2 to A7, the tripwires and archive/PREDICTIONS-2026-11-10.md use the narrower set. Both estimates are reported wherever the volume result is stated.
2. Placebo dates start 2026-03-10, not 2026-01-01, because CoinGecko's free daily history covers only the last 365 days.
3. On-chain sample (H5) replaced. The keyless block archive was too slow for the planned random block sample. H5 instead uses every transaction to intents.near from NEAR's public BigQuery dataset, which is a census rather than a sample. The 2-day and 5-day user tiers are post hoc. The withdrawal-to-deposit ratio was not computed.
4. Scroll and Plasma are not reported by DefiLlama, so H3 uses nine of the eleven paused networks.
5. Added after seeing results: the robustness grid, the NEAR/ZEC/other balance decomposition, the long-term section, the Confidential Intents trace and the Explorer API data (Part 2), the integrators and large swaps (Part 1), the measured buyback wallets and the pace test, the public-visibility analysis (appendix A7), the rival comparison, the hack-date sensitivity, the new/returning account split, the valuation multiple, the fee-timing check in H2 and the tripwires. None of these change a pre-registered verdict.

6. Position. archive/PREDICTIONS-2026-11-10.md names make fetch && make fetch-bq && make as its scorer; scoring later also needs the end date set: make fetch && END_DATE=2027-03-31 make fetch-bq && LAST_DAY=2027-03-31 make (only make fetch is strictly required, since P1 to P3 use DefiLlama). It also contains one error that cannot be edited without breaking its timestamp: P2's failure note says growth would have "stalled for 18 months"; if P2 fails in March 2027, the last record will be six months old and the first peak sixteen. Its first line also says "Written 2026-11-11", but its timestamp is 14:41 UTC on 2026-11-10: the date is wrong, and the timestamp is the date that counts. The pre-registration maps outcomes to a position only when the detection threshold is under 25%. It was not, so the position, its tripwire rule and the predictions in archive/PREDICTIONS-2026-11-10.md are my judgment, set after seeing the results.

7. Rating changed from Long to Hold. archive/PREDICTIONS-2026-11-10.md (timestamped 2026-11-10) says "Long NEAR". On 2026-11-11 I measured the three revenue wallets and found the NEAR reaching them is 16% of issuance, uneven by month, and paid to no one. I changed the rating to Hold and wrote one current file, RATING.md, with the rule, the three earlier predictions carried over and two further calls, timestamped with OpenTimestamps (RATING.md.ots). The first version is kept unchanged in archive/ so its proof still verifies; its exit to neutral is the rule's Avoid. The rule was written after seeing the wallet data, so its fit to the past months is not evidence; only its calls on later data are.

Sources

• Incident timeline: Cointelegraph, "NEAR Intents says it blocked $50M tied to Bitget hackers"; CoinDesk on the Bitget swaps and the permissionless claim; Zcash Community Forum and The Crypto Times on the $589k held for 50 days; CryptoTicker and DeFiPrime on the 1 October exploit and the halted networks; the NEAR Intents postmortem of 16 October.
• Confidential Intents: general availability to every app on 2026-07-08 per the NEAR Q3 2026 report (Nansen) and NEARStats; first launch 2026-02-25. Settlement and the Treasury account: docs.near-intents.org, integration/market-makers/confidential-intents and confidential-liquidity. The 1Click switch: docs.near-intents.org changelog, "1Click swaps settle confidentially" (2026-10-27).
• 1Click swaps: NEAR Intents Explorer API (explorer.near-intents.org/api/v0/transactions, partner token).
• Data: DefiLlama (Intents volume, fees, revenue and balances by token and chain; comparison-venue volumes) and CoinGecko (price, market cap and spot volume for NEAR, ZEC and BTC). URLs, fetch times and SHA-256 hashes are in data/raw/MANIFEST.json. NEAR chain data: NEAR's public BigQuery dataset (bigquery-public-data.crypto_near_mainnet_us), queries in sql/.

Part A. The pre-registered event study

Rules fixed in advance

What is and is not pre-registered:

I wrote the tests and decision rules in PREREGISTRATION.md before downloading any daily series. That ordering is my statement. What can be checked is the OpenTimestamps proof (PREREGISTRATION.md.ots): it anchors the file in Bitcoin block 975284, mined at 10:15 UTC on 2026-11-10. The download began 29 minutes earlier (09:46 UTC, data/raw/MANIFEST.json). So the plan was frozen within half an hour of the download: any revision after seeing the data had at most that long. The proof alone does not show the plan came first.

Pre-registered verdict: no collapse, but too imprecise to clear the 25% bar. With the donors as pre-registered, 28-day volume came in -24.3% against the model (placebo p = 0.34), with a detection threshold of -35.7%: a loss must be at least that large just to reach p = 0.10. With the narrower set, +1.0% (placebo p = 0.50; threshold -29.5%). The pre-registration required a threshold under 25% before calling the durability objection weakened. Neither set meets it, so I do not make that claim.

Rating: Hold. The pre-registration maps outcomes to a position only when the detection threshold is under 25%; it was not, so the rating is mine (deviations 6 and 7). archive/PREDICTIONS-2026-11-10.md, timestamped on 2026-11-10, set it at Long with two exits: neutral if a second tripwire breaks, or if Intents has not set a new monthly volume record by 2027-03-31. The next day I measured what reaches NEAR and changed the rating to Hold, by a rule written down and timestamped in RATING.md. 1 of 3 tripwires is broken now.

Predictions. archive/PREDICTIONS-2026-11-10.md was timestamped at 14:41 UTC on 2026-11-10 (Bitcoin block 975308), before the BigQuery data behind appendix A6 and A7 was fetched (14:55 UTC), so it predates the onchain findings. It commits the thesis to three dated, falsifiable calls to 2027-03-31, scored only on data after 2026-11-10 and timestamped with OpenTimestamps in Bitcoin block 975308 (archive/PREDICTIONS-2026-11-10.md.ots): order flow stays above its limit, Intents sets a new monthly volume record, and the take rate stays above its calm-period average.

A1. Volume: no detectable loss, size unknown (H1, primary)

The model fits log daily Intents volume on an index of comparison venues (the narrower set: chainflip-amm, socket-protocol, jumper-bridge-aggregator, rango; the pre-registered set is reported beside it) and on NEAR and ZEC spot volume, over 2026-06-01 to 2026-09-07 (R² = 0.72). Inference compares the real event window with 155 pseudo-events from calm periods.

• Calm-period pseudo-events range from -29.5% (10th percentile) to +18.5% (90th). The real result sits near the median (+1.9%).
• The first week was weak (-10.3%); over 14 days the average was +3.5%.
• Synthetic control (second pre-registered estimate): Intents came in +39.5% against a weighted blend of the same venues. Intents ranks 4 of 5 from the bottom when each venue is treated in turn. With five units no result can reach a placebo p below 0.20, so this estimate is a sign check, not a measure of size. The two estimators disagree widely on size; the verdict uses the pre-registered primary, which is the more conservative of the two.
• Dating the shock from the hack (sensitivity, not pre-registered): the blocking followed the Bitget hack of 2026-09-24, so 09-29, the date of the press reports, may be late. Starting the 28-day window on 09-24 gives -8.6%, inside the calm-period range.
• Against rival venues (exploratory, raw volume, no model): the answer depends on the baseline. Against the 28 days before 2026-09-29, Intents changed -16.0% and the median of 6 comparison venues -33.1%. But rivals rallied much harder in September. Against August, before the rally, Intents was +46.8% and the rival median +89.2%. So there is no evidence that Intents beat its rivals; the model, which controls for them, says it kept pace.
• Onchain cross-check (BigQuery, added after the pre-registration): the same model with onchain transactions relayed by intents.near as the outcome gives +8.3%. BigQuery data starts 2026-03-01, so only 44 calm windows fit, all in the summer uptrend. Against them both measures rank below every calm window: Intents had been beating its model by +7% to +26% (volume) and +12% to +44% (relayed transactions). The pre-registered test, with 155 calm windows back to 2026-03-10, puts the result mid-distribution. Both are true: no collapse, but the summer's outperformance stopped.
• DefiLlama's volume may have changed definition. Other entries report that a large share of DefiLlama's Intents volume does not appear as public onchain swaps, with a step around 2026-09-01. DefiLlama dollars per onchain transaction rose from 1,591 in August to 2,368 in September. That fits a definition change or bigger trades during the rally; I cannot tell which. A step up before the event window would make the event-window result look better than it was.
• In dollars, actual event-window volume was $3.71B against $3.63B predicted.

A2. Fees held up, but the premium predates the shocks (H2)

Fees came in +25.2% against the fee model over the event window (placebo p > 0.99). That is not an effect of the shocks. Abnormal fees were already +28.5% in the week before 2026-09-29, and fell to -1.3% after the event window.

The take rate tells the same story. It was 13.6 bps in the calm period, 16.4 bps in the three weeks before the shocks, 16.2 bps in the event window and 14.4 bps since. So the shocks did not force Intents to cut prices to keep users. The later decline is what the take-rate tripwire watches. A fee-schedule change would produce the same pattern, and I did not find or verify one.

A3. Balances on the paused networks dipped, then recovered (H3, exploit channel)

Balances are measured in token units at fixed 2026-09-28 prices, so price moves cannot pose as flows.

• On the BNB Chain, Polygon, TON, Optimism, Avalanche, Stellar, Monad, X Layer, ADI networks halted after the exploit, balances bottomed at -22.1% on 2026-10-02. Funds were returned on 2026-10-02.
• Four weeks later they stood at +27.5% relative to the pre-event level, compared with -14.7% on the other networks (placebo p = 0.63).
• These networks held only $7.5M of $267.1M, so this channel could never move the total much.

A4. Zcash holders did not flee, at first (H4, freeze channel)

Zcash is the asset most exposed to a freeze story: it was 18.3% of balances on 2026-09-28, and the 50-day hold involved a ZEC swap.

The pre-registered freeze-channel hypothesis is not supported: ZEC stayed within normal variation after both events. The drain came later. In the most recent 28 days ZEC units fell past the calm-period limit, so it is the tripwire that is now broken. It is too late to blame on the freeze with any confidence, and I have no test that separates it from the ZEC price cycle.

The opposite of the hypothesis did happen in the freeze window. Non-ZEC balances changed -15.0% in the 28 days from 2026-09-28, beyond their calm-period limit of +0.2%. Appendix A5 shows that this was mostly NEAR leaving after the September rally, not a broad exit.

A5. Where balances actually moved

Outside ZEC, the largest move was NEAR. NEAR units held on Intents rose sharply during the September rally and four weeks after 2026-09-28 they had changed by -28.9%. Everything that is neither NEAR nor ZEC was +2.6%. Total balances at fixed prices were still +26.7% above the end of the calm period. This decomposition is exploratory, not pre-registered.

A6. Onchain: established accounts pulled back (H5, exploratory)

Source: every transaction sent to intents.near from 2026-03-01 to 2026-11-09, from NEAR's public BigQuery dataset (sql/intents_signers_daily.sql). 82.6% of those transactions are signed by intents.near itself (relayed transactions, including 1Click), so they show no individual user and are excluded. What is left is 30,680 accounts that sign their own transactions: self-custody users, solvers and escrow contracts, a median of 130 active on a day.

The pre-registered measure is the re-sighting rate: the share of accounts active in the 28 days before 2026-09-29 that are active again in the 28 days after, against the same rate at 136 calm-period dates.

• The drop is among established accounts. Accounts seen before September came back less than in any calm-period window; brand-new accounts, most of them from a burst of sign-ups in mid-September, came back at their usual low rate. Heavy users came back as usual.
• Daily active accounts changed -26.3% (placebo p = 0.28), within normal variation.
• The ten most active accounts sent 96.7% of these transactions in the event window.
• The p-values rank the event against 136 calm-period dates whose 28-day windows overlap, about 5 independent windows. Read them as "lower than every calm window", not as a precise probability.
• The 2-day and 5-day tiers and the new/returning split were added after seeing the 1-day result. The query counts transactions whose receiver is intents.near, so deposits that arrive through token contracts are not in it, and the accounts include solvers and escrow contracts as well as users.

So the flow that held is mostly relayed and heavy-user flow. The accounts that pulled back are established ones that sign their own transactions.

A7. The public record left (exploratory, onchain)

Two measures built from the same intents.near events in NEAR's public BigQuery dataset.

Public swap volume. Every token_diff swap event logged by intents.near lists each party's balance change. Summing the stablecoin side (ten USDC and USDT tokens on Ethereum, Tron, Solana, Base, Arbitrum and NEAR) gives the dollar value of public swaps without a price feed (sql/intents_stable_volume_daily.sql). A stablecoin-to-stablecoin swap shows a stablecoin received on both sides, so half of that part is removed: 58% of the gross figure is such swaps, and counting both sides would put the summer share at 59% instead of 43%. Divided by DefiLlama's total, it gives the share of volume visible as public swaps.

Event counts. Every event intents.near logs, by name and format version, and every code deployment to it (sql/intents_event_counts_daily.sql, sql/intents_deploys.sql). Daily averages:

• The visible share first fell in September. That month every kind of activity dipped, swaps more than the rest, and it is also when other entries report a step in DefiLlama's own figures, so September alone proves little. Confidential Intents opening to every app on 2026-07-08 changed the share by -3.9% of its level, an ordinary change.
• intents.near was upgraded on 2026-10-02 and 2026-10-07; the event format changed from version 0.3 to 0.4 from 2026-10-02. Public swaps kept being logged under the new format. The clear split starts in late October, with no further deploy: public swaps fell to a fifth of August's level while transfers and executed intents roughly doubled.
• In the 28 days after the freeze the visible share fell by 19.5% of its level, more than in all but 5 of 256 overlapping calm windows (about 5 independent). That window contains the upgrade, so it cannot be credited to the freeze alone.
• The pre-registered model, run on public onchain volume instead of DefiLlama's total, gives -29.6% (placebo p = 0.18).
• Where the swaps went is Part 2: from 27 October 1Click swaps settle confidentially. Volume with no stablecoin leg, on unlisted chains or in nep245 tokens sits in DefiLlama's total but not in the numerator, so a mix shift would also lower the share; the event counts do not depend on that. Another entry (ervhint/tideline) independently reports that most counted volume now runs through the Confidential Intents treasury.