'We Have Identified You, Sir': Near Intents Recovers $3.8 Million After 48-Hour Ultimatum

In brief

• Near Intents recovered the full $3.8 million stolen in Thursday’s exploit, general manager Alex Shevchenko said Friday, and the team has ended its investigation.
• The return came after Shevchenko publicly told the attacker “We have identified you, sir” and gave them 48 hours to return the funds.
• An on-chain message that appears to come from the exploiter said “we were in the wrong” and urged others to use bug bounties.

Near Intents got its money back.

The cross-chain swap service said Friday that the roughly $3.8 million drained in an exploit on Thursday has been returned in full. The return came a day after the team publicly told the attacker it knew who they were.

“The funds from the $3.8M NEAR Intents hack were sent back in full,” Alex Shevchenko, general manager of Near Intents, wrote on X. “We are stopping the investigation.”

The turnaround was fast. On Thursday, Shevchenko posted Bitcoin, BNB/Ethereum and Solana addresses for returning the funds and addressed the attacker directly: “We have identified you, sir.”

He framed the return as a last chance at responsible disclosure, the practice of reporting a vulnerability to developers instead of exploiting it, and warned that the window would close after 48 hours.

An on-chain message attached to a transaction, which Shevchenko shared and which appears to come from the exploiter, struck a contrite tone. “We’ve returned all the funds, we were in the wrong,” it read. The message also thanked the Near team for being cordial during the process and urged others to use bug bounties.

BitcoinBTC · USD$86,246+3.95%24H7D1M1YYTDSep 28Sep 30Oct 1Oct 3Oct 5$86.8k$85.4k$84.0k$82.7k24h HighHigh$86,94924h LowLow$84,916VolVol$997.9M→Buy Bitcoin with USDTPowered by Jupiter$50$100$500BuyPrice data by CoinGeckoCoinGeckoMore Bitcoin news and projections →

Near Intents had halted service Thursday after a bug in how its Omni deposit and withdrawal layer interacted with its main smart contract let an attacker siphon funds. The team had pledged to compensate users in full and reported the incident to law enforcement. Blockchain sleuth ZachXBT said the stolen funds were sent to KuCoin and bridged to Bitcoin.

Near Intents lets users swap tokens across 35 blockchains by stating what they want and letting market makers compete to fill the order. It has processed more than $30 billion in swaps, according to data from the service.

The exploit capped a turbulent week. Two days earlier, Near Intents blocked a $50 million swap attempt by the hacker behind the roughly $387.5 million Bitget breach, which Bitget and blockchain analytics firm Elliptic have pinned on North Korea. The hack also came days after Bitwise’s spot NEAR ETF began trading.

“Please use bug bounties instead of disrupting the services,” Shevchenko wrote.

Daily Debrief Newsletter

Start every day with the top news stories right now, plus original features, a podcast, videos and more.