NEAR Intents says it has identified the individual responsible for a security breach that drained $3.8 million in user funds on Thursday, and has given the attacker 48 hours to return the assets under a "responsible disclosure" framework.

"We have identified you, sir," NEAR Intents general manager Alex Shevchenko wrote in an X post on Friday, attaching three wallet addresses for the return of funds in Bitcoin, BNB and Solana.

"You know better than most how responsible disclosure works — this is the last window to use it. After 48 hours, that window closes."

What happened in the exploit?

The protocol detected the incident on Thursday and paused services immediately. According to NEAR Intents' preliminary investigation, the root cause was a "bug in the Omni deposit and withdrawal infrastructure interaction with NEAR Intents smart contract."

The bug allowed an attacker to extract $3.8 million in user funds before the team halted operations. NEAR Intents has pledged to compensate affected users in full, regardless of how negotiations with the attacker proceed.

Blockchain investigator ZachXBT traced the stolen funds after the incident. He reported that the assets were transferred to the KuCoin exchange and bridged to Bitcoin — a movement pattern that typically complicates recovery efforts once funds are converted on a separate chain.

Why does the 48-hour deadline matter?

The ultimatum follows a playbook that has become standard practice among exploited protocols: offer a defined window for a negotiated return, often with an implied bounty, before pursuing legal remedies and law enforcement engagement. Once the window closes, teams generally escalate to civil suits, criminal referrals and permanent public attribution.

Shevchenko's decision to publish the message directly, addressed to the attacker and paired with specific return addresses across three ecosystems, signals the team believes its attribution is solid enough to warrant public disclosure rather than private negotiation.

What are the operational consequences?

The immediate business impact is a full service pause. With deposits and withdrawals suspended, users cannot move funds through the platform's intent-based routing while the team verifies the integrity of the Omni bridge interaction with the NEAR Intents smart contract.

The compensation pledge shifts the financial burden from users to the protocol, but it also creates a near-term liability of $3.8 million that the treasury or its backers must absorb if the recovery effort fails.

The exploit is the second security incident linked to the platform's broader ecosystem in short order, following a prior $3.8 million breach tied to assistance with the Bitget breach — a pattern that will intensify scrutiny of the deposit and withdrawal infrastructure the protocol depends on.

What comes next?

The deadline expires roughly 48 hours after Shevchenko's Friday post. If the attacker does not return the funds through the published Bitcoin, BNB or Solana addresses, NEAR Intents will likely move to public attribution, law enforcement referrals and recovery actions aimed at the KuCoin deposit trail documented by ZachXBT.