Near Intents recovers $3.8 million after 48-hour ultimatum to attacker

Near Intents said Friday that roughly $3.8 million drained in Thursday's exploit had been returned in full. The return came a day after the team publicly told the attacker that the team knew the attacker's identity. Near Intents general manager Alex Shevchenko confirmed the return and said the team was stopping its investigation.

Shevchenko posted Bitcoin, BNB/Ethereum and Solana addresses on Thursday for returning the funds. Shevchenko told the attacker, "We have identified you, sir." Shevchenko presented the return as a final opportunity for responsible disclosure and warned that the opportunity would expire after 48 hours. Responsible disclosure involves reporting a vulnerability to developers instead of exploiting the vulnerability.

Shevchenko shared an on-chain message attached to a transaction that appears to come from the exploiter. The message said, "We've returned all the funds, we were in the wrong." The message thanked the Near team for being cordial during the process and urged others to use bug bounties. Shevchenko also urged people to use bug bounties instead of disrupting services.

Near Intents halted service Thursday after a bug allowed an attacker to siphon funds. The bug involved how the service's Omni deposit and withdrawal layer interacted with its main smart contract. The team pledged to compensate users in full and reported the incident to law enforcement. Blockchain investigator ZachXBT said the stolen funds were sent to KuCoin and transferred to Bitcoin through a bridge.

Near Intents lets users swap tokens across 35 blockchains by stating their desired transaction and letting market makers compete to fill the order. Data from the service shows that Near Intents has processed more than $30 billion in swaps.

Two days before the exploit, Near Intents blocked a $50 million swap attempt by the hacker behind the roughly $387.5 million Bitget breach. Bitget and blockchain analytics firm Elliptic have attributed that breach to North Korea. The Near Intents exploit also came days after Bitwise's spot NEAR exchange-traded fund began trading.