Attacker Returns Funds After NEAR Intents Issues 48-Hour Recovery Deadline

TLDR General Manager Alex Shevchenko of NEAR Intents announced the complete recovery of approximately $3.8 million stolen during an October 1 security breach. A vulnerability was discovered in the interaction between NEAR Intents’ Omni deposit-withdrawal infrastructure and its underlying smart contract. Operations were temporarily suspended across 11 blockchain networks, including BNB Chain, Polygon, TON, and Avalanche, as teams responded to the incident. Blockchain forensics tracked the stolen assets moving through a BNB Chain hot wallet, the KuCoin exchange, and ultimately to a Bitcoin bridge. NEAR Protocol’s main blockchain infrastructure and its native cryptocurrency remained unaffected throughout the incident. NEAR Intents has successfully recovered the entire $3.8 million taken during a security breach that occurred on October 1. The protocol’s General Manager, Alex Shevchenko, announced the complete fund recovery following an intensive 48-hour period after the attack. The funds from the $3.8M NEAR Intents hack were sent back in full. We are stopping the investigation. Please use bug bounties instead of disrupting the services. — Alex Shevchenko (@AlexAuroraDev) October 2, 2026 Before the assets were returned, the protocol had publicly committed to compensating all impacted users in full. Consequently, the fund recovery primarily impacts NEAR Intents’ internal finances rather than representing an outstanding liability to its user base. Technical Breakdown of the Vulnerability The security flaw originated from a defect in the way NEAR Intents’ Omni deposit-withdrawal system communicated with its smart contract infrastructure. Technical analysis identified the vulnerability on the contract layer itself. LATEST: NEAR Intents’ $3.8M hacker has RETURNED every dollar. Less than 24 hours after NEAR Intents publicly identified the alleged exploiter and gave them 48 hours to return the funds, the attacker sent the full $3.8M back. The hacker also left an on-chain message… https://t.co/nb2kUTCvfLpic.twitter.com/ks9V22Fet7 — Coin Bureau (@coinbureau) October 3, 2026 Illia Polosukhin, co-founder of NEAR Protocol, clarified that the exploit specifically targeted USDT tokens on the Binance Smart Chain. He noted that SHIELD, the platform’s artificial intelligence-powered security monitoring system, detected the suspicious transactions and automatically implemented protective measures. Development teams deployed a patch addressing the contract vulnerability approximately one hour after detection. However, as a precautionary measure, deposit and withdrawal functionality remained disabled across multiple networks for nearly 12 additional hours while comprehensive security audits were completed. The temporary suspension impacted 11 blockchain ecosystems: BNB Chain, Polygon, TON, Optimism, Avalanche, Stellar, Monad, Scroll, and Plasma. NEAR Protocol emphasized that its foundational blockchain architecture and native digital asset were never compromised during the security event. Following the Digital Money Trail Blockchain security analysts traced the suspicious transactions back to infrastructure connected with the HOT Bridge treasury on BNB Chain. Security researcher ZachXBT separately identified anomalous fund movements originating from a BNB Chain address associated with NEAR Intents.