NEAR Intents recovers full stolen $3.8 million after 48-hour ultimatum to exploiter
Key Takeaways
- •NEAR Intents recovered the full $3.8 million stolen in Thursday's security breach after identifying the exploiter and issuing a 48-hour ultimatum for the funds' return.
- •The exploit stemmed from a bug in the interaction between the protocol's Omni deposit and withdrawal infrastructure and its smart contracts, leading services to be paused on Thursday.
- •General manager Alex Shevchenko announced the funds were returned in full, stated the investigation was being stopped, and encouraged attackers to use bug bounty programs instead.
- •Blockchain investigator ZachXBT had reported before the recovery that the stolen assets were transferred to the KuCoin exchange and bridged to Bitcoin.
- •The responsible disclosure approach gave the identified attacker a set window to return the funds and disclose the exploited vulnerability, with the team pledging full compensation to affected users.
NEAR Intents said it has recovered the full $3.8 million stolen during a security breach on Thursday, after the exploiter was identified and given 48 hours to return funds.
The incident unfolded over roughly two days: services were paused on Thursday after the bug was detected, the exploiter was identified and warned on Friday, and the funds were returned in full later that same day.
As reported by Cointelegraph on Friday, the protocol had identified the individual behind the breach and issued a 48-hour ultimatum for the money to be returned under "responsible disclosure" — an approach that gives an identified attacker a set window to return funds and disclose the vulnerability they exploited.
"The funds from the $3.8M NEAR Intents hack were sent back in full," NEAR Intents general manager Alex Shevchenko wrote on X. "We are stopping the investigation. Please use bug bounties instead of disrupting the services."
The message pointed to bug bounty programs — standing offers that pay security researchers for responsibly reporting flaws — as the channel the team wants would-be attackers to use.
What happened
NEAR Intents paused its services after detecting what it described as a "bug in the Omni deposit and withdrawal infrastructure interaction with NEAR Intents smart contract."
The flawed interaction sits at the core of how the protocol works: NEAR Intents is a cross-chain intents protocol that lets users trade assets across different blockchains, so the deposit and withdrawal path linking its infrastructure to its smart contracts is central to moving user funds.
NEAR's preliminary investigation determined that $3.8 million in user funds had been stolen, and the team pledged to compensate affected users in full.
Before the funds were returned, blockchain investigator ZachXBT reported that the stolen assets had been transferred to the KuCoin exchange and bridged to Bitcoin. Even so, the full amount came back within the ultimatum window, leaving affected users made whole.
Related: NEAR Intents says it's identified the hacker, gives 48-hour ultimatum
The team has now closed its investigation following the complete recovery of user funds. With that chapter shut, further detail from NEAR Intents on the underlying bug and any bounty program updates would show how the protocol follows through on Shevchenko's appeal.
