NEAR Intents Identifies $3.8M Hacker, Gives Them 48 Hours to Return Funds

NEAR Intents GM Alex Shevchenko has identified the attacker behind a $3.8 million exploit and given the hacker 48 hours to return the stolen funds, after a bug in its Omni deposit and withdrawal infrastructure was exploited.

The platform has restored most services and plans to compensate affected users in full while investigators trace the assets.

NEAR Intents Identifies Bug Behind $3.8M Exploit

Shevchenko’s post on X directly addressed the attacker: “We have identified you, sir.” He then asked the person responsible to return the funds to Bitcoin, BNB/Ethereum, and Solana addresses.

“You know better than most how responsible disclosure works — this is the last window to use it,” he told the hacker. “After 48 hours, that window closes.”

According to NEAR Intents’ own account, services were halted after a security incident was detected. A bug in how the Omni deposit and withdrawal infrastructure interacts with the NEAR Intents smart contract caused the loss, which a preliminary assessment put at approximately $3.8 million.

Illia Polosukhin, a NEAR co-founder, added that the exploit was isolated to USDT on BSC, and that SHIELD, the platform’s AI security layer, flagged outlier behavior and triggered the pause. The contract vulnerability was patched within an hour of detection, and NEAR Intents and near.com are back online.

Deposits and withdrawals on BSC, Polygon, TON, Optimism, Avalanche, Stellar, Monad, LayerX, Adi, Scroll and Plasma remained unavailable for about 12 additional hours while Omni fixes were completed.

Furthermore, the NEAR Protocol confirmed that it was fully operational, and that neither it nor its native NEAR token had been involved in the Intents incident. Data from CoinGecko at the time of writing shows the cryptocurrency down more than 5% in 24 hours, although other timeframes were all green, including a 166% jump in the last 30 days.

Affected users will be compensated in full, while the incident has been reported to law enforcement. NEAR Intents is also working with other security and blockchain analytics partners to trace the stolen assets.

AI-Equipped Attackers

Polosukhin argued that crypto is entering a period of more sophisticated attacks, naming Bitget, MetaMask and Lido as recent targets of criminals using AI systems.

“As a space, we need to be far more vigilant and raise the bar on both onchain contract standards and offchain monitoring and proactive prevention,” he wrote.

MetaMask confirmed an infrastructure security incident on October 1, after which it began exiting affected validators, while saying it saw no immediate threat to user wallets. Lido separately confirmed the compromise and started taking precautionary steps as well to protect client assets linked to its Ethereum validators.

Meanwhile, Bitget is reeling from a $387 million hack that happened on September 24, with the attacker laundering the funds via CoW Protocol and Chainflip.

The AI researcher now wants the industry to “raise the bar on both onchain contract standards and offchain monitoring.” His own firm plans to add formal verification to its contract release process and is inviting new SHIELD partners to share information faster. He also pointed out that the platform now processes over $4 billion a month, and that this was its first major exploit.