NEAR Intents Hacker Returns $3.8M After 'We Have Identified You, Sir' Ultimatum 🤝

Cross-chain swap service NEAR Intents has recovered roughly $3.8 million drained in a Thursday exploit, after publicly identifying the attacker and issuing a 48-hour deadline to return the money as a final chance at responsible disclosure. "The funds from the $3.8M NEAR Intents hack were sent back in full," Alex Shevchenko, general manager of NEAR Intents, wrote on X on Friday. "We are stopping the investigation. Please use bug bounties instead of disrupting the services."

NEAR Intents paused services on Thursday after detecting a bug in how its Omni deposit and withdrawal layer interacted with its NEAR Intents smart contract, siphoning $3.8 million in user funds. The team pledged to compensate affected users in full and reported the incident to law enforcement. Core services resumed within roughly an hour, though deposits and withdrawals on 11 networks including BNB Chain, Polygon, and Optimism remained offline for about 12 hours while the remainder of the fix was deployed.

The day after the breach, Shevchenko posted Bitcoin, BNB/Ethereum and Solana addresses for returning the funds and addressed the attacker directly: "We have identified you, sir." He framed the deadline as a last chance at responsible disclosure, the practice of reporting a vulnerability to developers instead of exploiting it, and warned the window would close after 48 hours. An on-chain message attached to a transaction, which Shevchenko shared and which appears to come from the exploiter, struck a contrite tone: "We've returned all the funds, we were in the wrong." The message also thanked the NEAR team for being cordial during the process and urged others to use bug bounties.

Blockchain investigator ZachXBT traced the stolen funds to the KuCoin exchange, where they were converted to bitcoin. NEAR Intents allows users to swap tokens across 35 blockchains by stating what they want and letting market makers compete to fill the order, and has processed more than $30 billion in swaps according to data from the service.

The exploit capped a turbulent stretch for the protocol. Two days earlier, NEAR Intents blocked a $50 million swap attempt by the hacker behind the roughly $387.5 million Bitget breach, which Bitget and blockchain analytics firm Elliptic have pinned on North Korea. The incident also came days after Bitwise's spot NEAR ETF began trading; NEAR fell nearly 9% to $4.86 following the hack, and shares of the Bitwise NEAR ETF dropped more than 7%.