NEAR Intents’ $3.8 Million Return Includes Monero, With Conversion Still Pending

NEAR Intents says it recovered the assets taken in an exploit valued at about $3.8 million, but returning the funds to their intended destination has involved more than tracing transactions. Part of the return arrived in Bitcoin and part in Monero (XMR), leaving the team to work through converting the privacy-focused asset into USDT. The protocol’s general manager, Alex Shevchenko, discussed the recovery in an episode of Unchained recorded Oct. 8.

The distinction matters because the team’s initial view of where the stolen assets had gone was incomplete. After the Oct. 1 exploit, the team believed the portion that wasn’t in Bitcoin remained on Ethereum, BNB Chain and Solana. Shevchenko said the Bitcoin assets were correctly identified, while the other funds had moved through channels that were harder to trace and had been traded into XMR.

That shift changed the practical problem facing the recovery effort. The team needed to receive Monero, then work out how to turn it into a form that could be returned. Shevchenko said the attacker contacted NEAR Intents in part to ask for the Monero address to use for the transfer.

Recovery and conversion are separate steps

On Oct. 2, Shevchenko posted that the funds had been sent back in full and that the team was ending its investigation. Independent onchain analyst Kuncoro then examined the published return addresses. The Bitcoin address had received 34.59 BTC, which Kuncoro calculated as about 78% of the total. The remaining portion, the analyst observed, had come back by another route. Shevchenko agreed in a reply.

Those figures establish the Bitcoin share but don’t disclose how much arrived in Monero. Shevchenko said the XMR portion was still being handled when asked whether the protocol retained it. The team had already replenished its smart contracts using its own funds, he said. The remaining task was to get the returned value back to its intended recipients.

That means converting the XMR into USDT. Shevchenko said companies involved in that process had asked about the funds’ origin, raising a practical hurdle for the team. He didn’t describe the conversion route, name the companies or say when it would be complete. He also said his first experience handling Monero came during the exploit response.

For a recovery involving multiple assets, the distinction between funds being returned and funds being available for distribution is consequential. A balance can be back under a team’s control while still requiring operational work before it can be passed on. Here, NEAR Intents says its contracts have been replenished, while the outstanding step described by Shevchenko concerns converting the XMR and returning that value.

Encrypted contact with the attacker

Shevchenko also described how he and the attacker established a private communication channel. After the attacker sent an onchain message offering to cooperate and asking for a Signal contact, Shevchenko posted an encrypted message containing an invite to a Signal group.

According to Shevchenko, the message was encrypted using the attacker’s public key. That meant the attacker was the only person able to decrypt it and open the invite. The account offers a specific example of how a recovery team can use information tied to an onchain identity to set up a separate channel, while keeping the invite inaccessible to other readers of the post.

The private conversation also provided a way to coordinate the Monero return: the attacker needed the right address to send the XMR. The available account doesn’t give further detail about the exchange between the parties or explain how the amount returned in each asset was agreed.

Bug bounty submissions after the exploit

Shevchenko reiterated his call for hackers to report vulnerabilities through bug bounty programs. NEAR Intents has received several submissions since the exploit, he said, and one was valid and will be paid. The account doesn’t specify the reward or describe the finding.

That response places the exploit alongside a continuing effort to gather vulnerability reports, though the source provides no details on changes to the protocol’s security controls. The reported recovery also leaves two distinct measures to track: whether the returned XMR can be converted into USDT, and whether the funds can then be delivered back to their intended recipients.

Related listening: How NEAR Intents Squares Blocking Black Money With Decentralization.

Source reporting: Unchained’s account of how NEAR Intents identified a suspect and recovered funds; coverage of the Oct. 1 exploit; and coverage of the reported return.