NEAR Intents Recovers the Full $3.8 Million After a 48-Hour Ultimatum

NEAR Intents says every dollar taken in a $3.8 million cross-chain exploit has been returned, turning what looked like a costly security failure into an unusually fast recovery.

The funds came back after the team identified the party it believed was responsible and issued a 48-hour deadline. Alex Shevchenko, general manager of NEAR Intents, then announced that the investigation was over.

Cointelegraph reports that the full amount was returned after the ultimatum, sparing the protocol from having to make good on its earlier promise to compensate affected users from its own resources.

The speed is the most striking part. Crypto exploits routinely lead to weeks of tracing, negotiations and partial recoveries.

Here, the public timeline ran from a service halt and compensation pledge to a full return in roughly a day. The team said it had identified the alleged exploiter and supplied addresses for returning assets on Bitcoin, BNB Chain, Ethereum and Solana.

The deadline was October 4, yet the announcement arrived early. That gave users a concrete result before the protocol had published its promised technical post-mortem.

The funds from the $3.8M NEAR Intents hack were sent back in full.

We are stopping the investigation.

Please use bug bounties instead of disrupting the services.

— Alex Shevchenko 🇺🇦 (@AlexAuroraDev) October 2, 2026

The incident began with a flaw involving the protocol’s Omni deposit and withdrawal infrastructure. NEAR Intents temporarily halted services, patched the vulnerable contract interaction and warned that deposits and withdrawals on 11 networks would take longer to restore.

The Block reported that the protocol promised full compensation while tracing continued. It also cited blockchain investigator ZachXBT’s finding that funds had moved through KuCoin and into Bitcoin, illustrating how quickly a cross-chain incident can spread beyond its starting point.

The money’s return changed the immediate financial outcome without answering how the control failure happened. Users were no longer waiting on a reimbursement plan, and the team could shift from asset recovery to the harder work of explaining exactly what failed.

The original disruption reached well beyond one chain. BSC, Polygon and Optimism were among 11 networks where deposits and withdrawals remained unavailable while the vulnerable interaction was patched and services were restored.

That sequence matters for a protocol built around moving assets across networks. A bug in the connective layer can force users on many chains to wait even when the exploit begins in one piece of infrastructure.

The funds from the $3.8M NEAR Intents exploit have been returned, just one day later, and the investigation is closed.

Thanks to SHIELD, the AI security layer on Intents, along with some aggressive detective work, the Intents team identified the party responsible less than 24h… https://t.co/O2NvTnGxBv

— Illia (root.near) (🇺🇦, ⋈) (@ilblackdragon) October 2, 2026

NEAR co-founder Illia Polosukhin credited SHIELD, an AI security layer used by Intents, along with what he described as aggressive detective work. He said the responsible party was identified in less than 24 hours and communication was established before the money came back.

The Crypto Times adds an on-chain clue: a successful BNB Chain transaction carried a message saying the funds had been returned. The report also notes that Bitcoin accounted for most of the recovered value, while other assets came back through additional routes.

Those details support the broad recovery claim, but they do not answer every security question. The team has not publicly explained the tracing methods in detail, identified the person behind the addresses or shown whether law enforcement played a role in securing the return.

That makes the promised post-mortem important. A full recovery is good news for users, but it is not a substitute for understanding why the vulnerable interaction existed, how long it was exposed and what controls now prevent a repeat.

The cleanest lesson is also the least glamorous: rapid detection and direct communication can change the outcome of an exploit, but prevention still matters more than recovery.

NEAR Intents got the money back. Its next test is proving that the same path cannot be used again.

Join the conversation!

We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.