NEAR Intents Says $3.8 Million Exploit Funds Were Returned

NEAR Intents general manager Alex Shevchenko said the roughly $3.8 million taken in an exploit was returned in full. The recovery follows a response that briefly froze deposits and withdrawals across 11 networks.

For affected users, the important distinction is timing. NEAR Intents had already committed to compensate the loss before the funds came back, so the return affects the protocol's balance sheet rather than the reimbursement it owed users.

The Bug Sat Between Two Systems

NEAR Intents halted services on October 1 after detecting a bug involving the interaction between its Omni deposit and withdrawal infrastructure and an Intents smart contract. The flaw was on the contract side and was patched shortly after detection.

That distinction matters. NEAR Intents coordinates deposits, withdrawals and cross-chain execution across several networks. A problem in one connected component can therefore stop activity far beyond the blockchain where the abnormal activity was first seen.

The initial response affected deposits and withdrawals across 11 networks, including BNB Chain, Polygon, TON, Optimism, Avalanche, Stellar and Scroll.

The Money Moved Through BNB Chain

Initial analysis traced the abnormal activity to infrastructure associated with the HOT Bridge treasury on BNB Chain, rather than to the NEAR blockchain itself. Blockchain investigator ZachXBT also identified abnormal outflows from a BNB Chain hot wallet associated with NEAR Intents.

The assets were transferred through KuCoin and then bridged into Bitcoin, according to that analysis. The available evidence does not establish that the base NEAR chain itself was compromised.

Midway through the response, the address responsible for moving the funds began offering cooperation. It sent 0.295 ETH on Ethereum, then about an hour later sent 1 BNB to a recovery wallet. Both transfers carried a message requesting the recipient's Signal contact details.

A Public Deadline Set a Recovery Path

Shevchenko later published three return addresses, one each for Bitcoin, BNB Chain and Solana. The addresses appeared alongside a 48-hour deadline for the suspected attacker.

In the ultimatum, Shevchenko wrote, "We have identified you, sir," and described responsible disclosure as a closing window. He has not publicly named the attacker or shown evidence supporting the identification claim.

As of early October 2, none of the three addresses had received the stolen funds. The Bitcoin recovery address later received about 34.59 BTC. The supplied reporting does not include direct on-chain verification of that arrival, and it does not explain how the other assets returned.

What Full Recovery Changes

A voluntary return doesn't erase the need for a post-mortem. The incident crossed several infrastructure layers: a BNB Chain hot wallet, an exchange, a Bitcoin bridge, cross-chain contracts and a system serving 11 networks. Understanding where those connections failed is more useful than treating the return as a complete answer.

NEAR Intents reported the incident to law enforcement, while security and blockchain analytics firms assisted with tracing and recovery. A fuller post-mortem has been promised, but its publication and contents were not confirmed by the available reporting.

The return does remove the immediate loss of about $3.8 million and spare users a reimbursement process that the protocol had already promised to fund. But until the post-mortem explains the flaw and the recovery path in detail, the larger cross-chain lesson remains unsettled. The money came back. The design failure that let it leave is still awaiting a full explanation.