NEAR Intents Recovers Full $3.8 Million Stolen in Security…

Published: October 3, 2026 – 15:07 UTC

NEAR Intents says the full $3.8 million taken during this week's security breach has been returned, bringing the asset-recovery phase of the incident to a close roughly a day after the protocol said it had identified the alleged attacker and gave them 48 hours to return the funds.General Manager Alex Shevchenko confirmed the recovery on Oct. 2, saying the stolen assets had been “sent back in full” and that NEAR Intents was stopping its investigation. The return came before the deadline attached to the protocol's offer of what Shevchenko described as a responsible-disclosure window.The rapid recovery changes the financial impact of an incident that initially forced NEAR Intents to pause services and promise to compensate affected users. FinanceFeeds reported Friday that the protocol had published recovery addresses for Bitcoin, BNB Chain and Solana after saying it had identified the person responsible.

How Was the $3.8 Million Returned?

The recovered assets appear to have arrived through several routes rather than a single transaction. Public analysis of the addresses provided by Shevchenko showed approximately 34.59 Bitcoin moving into the designated Bitcoin recovery address on Oct. 2, representing close to $3 million at prices around the time of the transfers.Smaller amounts were visible through other published addresses, while the complete route used to reconcile the remainder has not been publicly broken down by NEAR Intents. Shevchenko nevertheless confirmed that the total amount had been recovered.That follows an unusual sequence after the exploit. Blockchain investigator ZachXBT had traced stolen assets from the affected infrastructure to KuCoin before they were bridged into Bitcoin. FinanceFeeds' initial investigation of the $3.8 million incident found that the irregular withdrawals involved infrastructure associated with the HOT Bridge treasury on BNB Chain rather than evidence that the NEAR base blockchain itself had been compromised.The return of the money resolves the immediate asset shortfall, but it does not establish who controlled each wallet in the transaction trail or by itself explain how the underlying vulnerability worked.

Investor Takeaway

Full recovery materially reduces the direct financial loss from the incident, but it should not be treated as equivalent to resolving the security failure. The more important remaining disclosure is the technical explanation of why unauthorized withdrawals were possible.

What Caused the NEAR Intents Exploit?

NEAR Intents said the incident resulted from a bug in the interaction between its Omni deposit-and-withdrawal infrastructure and a NEAR Intents smart contract. The protocol stopped services after detecting the problem and initially estimated the loss at approximately $3.8 million.The contract-side vulnerability was subsequently patched, while deposits and withdrawals across several networks were temporarily affected as the team worked on the broader Omni infrastructure.A detailed technical post-mortem has not yet established precisely which validation or authorization mechanism allowed the attacker to remove the funds. That distinction matters for determining whether the flaw was confined to one withdrawal path or exposed a reusable weakness in the system connecting NEAR Intents with cross-chain infrastructure.The incident came shortly after NEAR Intents said its SHIELD security system had helped block attempts to move more than $50 million connected with another major crypto theft. FinanceFeeds previously reported that NEAR Intents rejected those attempted transfers and froze roughly $503,000.

Investor Takeaway

The contrast shows that transaction screening and infrastructure security are separate controls. A protocol can successfully detect suspicious funds moving through its system while still containing vulnerabilities in the components responsible for deposits, withdrawals or settlement.

Why Does the Full Recovery Matter?

Crypto protocols frequently respond to exploits by offering attackers a bounty, legal safe harbor or a deadline for returning funds. Successful full recoveries are less common, particularly once assets have moved through centralized exchanges and across chains.The NEAR Intents outcome compares favorably with cases where only part of the stolen value is recovered. FinanceFeeds recently reported that Symbiosis recovered 15 Bitcoin after its native bridge exploit, while uncertainty remained over the relationship between recovered assets and the attacker's realized proceeds.NEAR Intents had already promised to make affected users whole, meaning recovery also reduces the amount the protocol or its backers would otherwise have needed to fund directly.

Investor Takeaway

With the $3.8 million returned, attention shifts from solvency and reimbursement toward operational risk. Confirmation that affected services are fully restored, an independent review of the patch and a detailed post-mortem will provide better evidence of whether the underlying risk has been contained.

What Still Needs to Be Explained?

NEAR Intents has ended its investigation into recovering the money, but several technical questions remain unanswered publicly. These include the exact flaw that authorized the withdrawals, whether existing monitoring could have detected the exploit sooner, which infrastructure components required remediation and whether additional safeguards have been introduced.The protocol also has not publicly disclosed the identity of the individual it said it had identified or detailed the investigative methods used to trace them.For users and counterparties, the return of funds closes the most immediate part of the incident. The forthcoming technical disclosures will determine whether the episode was a narrowly contained software defect or evidence of a wider weakness in the cross-chain architecture supporting NEAR Intents.

Source: FinanceFeeds