NEAR Intents Recovers $3.8 Million After Exploit and Ends Inquiry

NEAR Intents says it has recovered the full $3.8 million lost in an Oct. 1 exploit and has stopped its inquiry into the incident. The recovery came after the protocol’s general manager, Alex Shevchenko, publicly addressed the person responsible and shared addresses across Bitcoin, BNB/Ethereum and Solana.

“The funds from the $3.8M NEAR Intents hack were sent back in full,” Shevchenko wrote on X, adding that the team was stopping its investigation. The return followed a public appeal roughly 14 hours earlier. Shevchenko said the team had identified the person involved, urged them to use responsible disclosure, and gave them 48 hours to do so.

The sequence matters: the team says it established contact and recovered the funds, but it hasn’t described how it identified the person or what communication led to the return. Those details would help clarify which tracing methods proved useful and whether the recovery depended on cooperation, technical controls, or both.

Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.

On-chain transfers account for most of the reported recovery

Blockchain data shows that the Bitcoin address Shevchenko posted received about 34.6 BTC in several transfers between 14:31 and 15:05 UTC on Friday. That amount did not, by itself, equal the full $3.8 million loss. On-chain researcher Kuncoro estimated that the Bitcoin was worth about 78% of the total and asked whether the remainder had been returned through another route.

Shevchenko confirmed that it had, but did not explain how the balance was returned. That leaves the public record incomplete: the team reports full recovery, while the visible Bitcoin transfers cover only part of the stated loss. The source of the remaining amount and the assets involved haven’t been specified.

About an hour after the Bitcoin transfers, a transaction to the BNB/Ethereum address included a message in its data field: “We’ve returned all the funds, we were in the wrong.” The transaction can be viewed on-chain. The note provides a direct statement accompanying the transfer, but it doesn’t establish the identity of the sender or explain the exploit.

Team credits SHIELD and internal tracing

NEAR co-founder Illia Polosukhin said the team identified the party responsible less than 24 hours after the incident, made contact, and recovered the funds in full at 14:30 UTC. He credited SHIELD, described as the AI security layer on Intents, together with “some aggressive detective work.” When asked who performed the tracing, Shevchenko answered that it was the internal team.

Neither executive has given a technical account of how the identification worked. That distinction is relevant for users and developers: a successful recovery is not the same as a public explanation of the vulnerability or the method used to trace funds. A fuller technical account could help other teams assess whether similar infrastructure interactions pose risks to their own systems.

The reported flaw involved Omni deposits and withdrawals

NEAR Intents halted its services on Oct. 1, attributing the incident to “a bug in the Omni deposit and withdrawal infrastructure interaction with NEAR Intents smart contract.” The team said it would compensate affected users and that a detailed report would follow.

Polosukhin said the flaw was limited to USDT on BSC, was patched in under an hour, and did not affect the NEAR blockchain or its token. He also said Intents handles more than $4 billion a month in trading and payments, and called the incident its first major exploit. The source does not provide the promised technical report, so the precise failure mode, affected transaction flow, and steps taken to prevent a recurrence remain unclear.

For users, the immediate reported outcome is that the lost funds were returned and services had been halted while the issue was addressed. For developers and other protocol teams, the incident points to the importance of examining the interfaces between deposit and withdrawal infrastructure and smart contracts, not just the contract code in isolation. The available account doesn’t establish whether the fix changed those interfaces or added other controls.

The exploit came days after NEAR Intents blocked stolen Bitget funds from moving through the protocol. Shevchenko urged hackers to use bug bounties rather than disrupt services, and Polosukhin said those programs exist for a reason. A bounty can give researchers a route to report vulnerabilities without triggering an exploit, but the source provides no details about the program terms or whether the Oct. 1 flaw had been reported through one.

The next useful disclosure would be the technical account the team said it would provide: how the Omni interaction failed, what exactly was patched, and what users or integrators should check. Until then, the recovery is clear in the team’s statements, while the mechanics behind both the exploit and its resolution remain only partly public.

Related Listen: How Bitget Is Chasing $388 Million in Stolen Funds After a Zero-Day Hack

The post NEAR Intents Says Exploited $3.8 Million Is Back, Closes Its Hack Investigation appeared first on Unchained.