After issuing a 48-hour ultimatum that said, ‘We Have Identified You, Sir,’ Near Intents Recovers $3,800,000

Near Intents said Friday that the roughly $3.8 million drained from a Thursday exploit had been returned in full, and general manager Alex Shevchenko said the team had ended its investigation. The recovery came one day after the service publicly told the attacker it had identified them and set a 48-hour deadline to send the funds back.

A Public Warning and a Fast Reversal

Shevchenko wrote on X that the funds from the $3.8M NEAR Intents hack were sent back in full and that the team was stopping its investigation. The turnaround followed a direct appeal posted on Thursday, when he shared Bitcoin, BNB/Ethereum and Solana addresses for returning the money and told the attacker, “We have identified you, sir.”

He described the return as a final opportunity for responsible disclosure, the practice of reporting a vulnerability to developers instead of exploiting it, and warned that the window would close after 48 hours. A message attached to an on-chain transaction, which Shevchenko shared and which appears to come from the exploiter, took a contrite tone: “We've returned all the funds, we were in the wrong.” It also thanked the Near team for being cordial during the process and urged others to use bug bounties.

A Cross-Chain Service Halted by a Contract Interaction

Near Intents paused service on Thursday after a bug in how its Omni deposit and withdrawal layer interacted with its main smart contract allowed an attacker to siphon funds. The team pledged to compensate users in full and reported the incident to law enforcement.

Blockchain sleuth ZachXBT said the stolen funds were sent to KuCoin and bridged to Bitcoin. The service lets users swap tokens across 35 blockchains by stating what they want and letting market makers compete to fill the order. According to data from the service, it has processed more than $30 billion in swaps.

A Turbulent Week Around NEAR

The exploit capped a turbulent stretch for Near Intents and for NEAR-related activity. Two days earlier, the service blocked a $50 million swap attempt by the hacker behind the roughly $387.5 million Bitget breach, which Bitget and blockchain analytics firm Elliptic have pinned on North Korea. The hack also came days after Bitwise's spot NEAR ETF began trading.

Shevchenko closed the episode with a message aimed at future attackers: “Please use bug bounties instead of disrupting the services.”

What the Outcome Means

For readers tracking cross-chain infrastructure, the episode shows how quickly a high-value exploit can turn into a full recovery when a team combines public pressure, a clear deadline and direct communication with the attacker. It also underscores the risk concentrated in interoperability layers: a flaw in how one deposit-and-withdrawal system interacts with a main smart contract can pause a service that connects dozens of blockchains.

The return of the funds does not erase the vulnerability, but it shifts the story from a loss for users to a test of incident response, responsible disclosure and the effectiveness of bug bounty norms in a market where swap platforms hold billions in volume.