NEAR Intents has successfully recovered approximately $3.8 million in digital assets that were stolen earlier this week during a security breach targeting its infrastructure. The swift recovery comes after the project team identified the perpetrator and issued a firm 48-hour ultimatum, successfully convincing the attacker to return the funds under the framework of responsible disclosure before formal legal and law enforcement investigations escalated further.
The incident began earlier in the week when NEAR Intents detected unauthorized activity affecting its platform. According to the project’s preliminary investigations, the security breach was traced back to a specific technical vulnerability. The exploit involved a critical bug located within the interaction between the Omni deposit and withdrawal infrastructure and the NEAR Intents smart contract. Capitalizing on this flaw, the attacker managed to siphon off approximately $3.8 million in user funds before the team could fully mitigate the vector.
Upon discovering the breach, NEAR Intents acted quickly to contain the damage. The protocol immediately paused its operational services to prevent any further unauthorized withdrawals or cascading vulnerabilities across connected liquidity pools and smart contracts. At the time of the initial shock, the project issued public updates acknowledging the loss of user funds and explicitly pledging that, regardless of the recovery outcome, all affected users would be fully compensated out of pocket by the protocol to ensure zero net loss for the community.
As the technical team worked around the clock to audit their smart contracts and analyze the transaction logs, independent blockchain security experts also began tracking the movement of the stolen assets. Prominent on-chain investigator ZachXBT published findings indicating that the exploiter had attempted to obscure the trail of the stolen capital. According to the investigator’s tracking, the funds from the security incident were initially transferred into the ecosystem of the KuCoin cryptocurrency exchange and subsequently bridged over to the Bitcoin network in an effort to launder or disperse the digital assets across different chains.
Despite the obfuscation attempts, the persistent efforts of the NEAR Intents team and cybersecurity analysts yielded results swiftly. By Friday, the project announced that it had successfully identified the individual or entity responsible for the security breach. Armed with this critical identifying information, NEAR Intents publicly reached out to the hacker, giving them a strict 48-hour ultimatum to return the entirety of the stolen funds voluntarily under the umbrella of responsible disclosure. This approach, frequently utilized in the decentralized finance and broader Web3 sector, offers exploiters a pathway to avoid severe legal consequences and law enforcement intervention in exchange for full restitution.
The gamble paid off later on Friday when Alex Shevchenko, the general manager of NEAR Intents, took to social media to announce the successful and complete resolution of the crisis. Writing on the platform X, Shevchenko confirmed that the funds had been restored to the protocol without any permanent loss.
"The funds from the $3.8M NEAR Intents hack were sent back in full," Shevchenko wrote in his public statement. "We are stopping the investigation. Please use bug bounties instead of disrupting the services."
With the recovery of the complete $3.8 million sum, NEAR Intents has officially concluded its active internal and external investigations into the exploit. The incident highlights both the persistent vulnerabilities facing complex cross-chain and smart contract integrations within the decentralized finance landscape and the evolving dynamics of incident response in the blockchain sector, where swift attribution and strategic ultimatums can sometimes yield the return of funds that might otherwise be permanently lost to cross-chain laundering techniques. The team is now expected to focus on strengthening its infrastructure security, reviewing its Omni deposit and withdrawal mechanics, and ensuring that robust preventative measures are in place before resuming full operational capacity for its user base.
Leave a Reply