NEAR Intents Recovers $3.8 Million Stolen in Security Breach Following Ultimatum

NEAR Intents has successfully recovered approximately $3.8 million in digital assets that were stolen earlier this week during a security breach, bringing a swift resolution to an incident that had temporarily disrupted its protocol operations.

The successful recovery follows a tense 48-hour window during which the project’s development team identified the alleged perpetrator and issued a stern warning under the framework of responsible disclosure. The breach, which sent ripples through the decentralized finance community, highlighted both the vulnerabilities inherent in cross-chain infrastructure and the evolving tactics used by protocols to recover funds without resorting to prolonged legal battles or adversarial tracking.

The sequence of events began on Thursday when NEAR Intents detected abnormal activity affecting its platform. According to subsequent technical disclosures, the exploit was traced to a specific technical vulnerability. The security breach stemmed from a bug within the interaction mechanics between the Omni deposit and withdrawal infrastructure and the NEAR Intents smart contract. This oversight allowed an unauthorized entity to siphon user funds from the protocol, resulting in a total loss estimated at $3.8 million.

Immediately upon discovering the anomaly, NEAR Intents took decisive action by pausing its core services to contain the threat and prevent any further unauthorized outflows. A preliminary investigation conducted by the project’s internal security team confirmed the scale of the financial loss, prompting leadership to issue an immediate public pledge assuring affected users that they would be fully compensated regardless of whether the stolen assets could be recovered.

As the platform worked internally to diagnose the root cause of the exploit, prominent on-chain analysts began tracking the movement of the stolen capital. Notable blockchain investigator ZachXBT reported that the funds pilfered during the incident had been actively moved across networks. According to ZachXBT’s tracking data, the assets were initially funneled into the KuCoin centralized exchange before being systematically bridged to Bitcoin, a common technique employed by malicious actors to obscure transaction trails and liquidate stolen cryptocurrencies across different blockchain ecosystems.

Despite the cross-chain obfuscation efforts, the NEAR Intents team maintained pressure and continued their forensic analysis. By Friday, the investigative efforts bore fruit when the protocol publicly announced that it had successfully identified the individual responsible for the security breach. Armed with this knowledge, NEAR Intents adopted a strategy frequently utilized in modern cryptocurrency incident response: a public ultimatum framed around responsible disclosure. The protocol gave the hacker a strict 48-hour deadline to return the stolen capital voluntarily, signaling that cooperation within this timeframe would alter how the incident was handled legally and publicly.

The pressure campaign yielded rapid results later that same day. Alex Shevchenko, the general manager of NEAR Intents, took to social media to announce that the stolen funds had been returned in their entirety. Writing on X, Shevchenko confirmed that the entirety of the $3.8 million drained during the exploit had been sent back to the protocol wallets.

With the financial integrity of the platform restored and user funds accounted for, Shevchenko announced an immediate closure to the incident response phase. "The funds from the $3.8M NEAR Intents hack were sent back in full," Shevchenko wrote. "We are stopping the investigation. Please use bug bounties instead of disrupting the services."

The rapid conclusion of the NEAR Intents exploit underscores a growing trend within the decentralized finance sector, where protocols frequently leverage identification and direct negotiation—often backed by white-hat communications or ultimatums—to recover user funds swiftly. By convincing the exploiter to return the assets within hours rather than days, NEAR Intents managed to avoid the protracted legal challenges, asset freezes, and complex cross-jurisdictional law enforcement coordination that typically accompany major cryptocurrency thefts.

Furthermore, the incident has brought renewed attention to the critical importance of robust smart contract auditing and infrastructure security, particularly when dealing with complex cross-chain interactions like those involving Omni deposits and withdrawals. As decentralized finance protocols continue to innovate and interconnect disparate blockchain networks, maintaining rigorous security standards remains paramount.

With the funds successfully recovered and services secured, the focus for NEAR Intents now shifts back to normal operations and ensuring that similar vulnerabilities are preemptively identified through formalized security measures such as bug bounty programs, which offer ethical hackers a legitimate and lucrative avenue for reporting vulnerabilities rather than exploiting them.