NEAR Intents has recovered the full $3.8 million drained from the cross-chain trading protocol, after the attacker returned the funds just hours after being publicly identified and handed a 48-hour repayment deadline.

The exploit, disclosed on Thursday, October 1, stemmed from a vulnerability in how the protocol's Omni deposit and withdrawal infrastructure interacted with its smart contracts. NEAR Intents paused operations after its SHIELD anomaly detection system flagged suspicious transactions and initially estimated user losses at roughly $3.8 million.

Alex Shevchenko, general manager of NEAR Intents, confirmed the recovery in a post on X on Friday. "We are stopping the investigation. Please use bug bounties instead of disrupting the services," he wrote.

The attacker attached a brief message to the return transaction: "We've returned all the funds, we were in the wrong."

How did the standoff end?

The resolution capped a rapid sequence of events. Shevchenko posted three wallet addresses linked to the attacker — one each for Bitcoin, BNB and Solana — and told the perpetrator the clock was running. "We have identified you, sir," he wrote, setting a 48-hour deadline for repayment. The funds came back within hours of that demand.

Before the return, Shevchenko had opened a private channel to communicate with the attacker. In one post he thanked the individual "for your willingness to cooperate" and pointed to messages that could be decrypted with the private key from an Ethereum address.

What was the operational impact?

NEAR Intents lets users state the outcome they want from a trade, after which independent market makers called solvers compete to find the optimal route. Smart contracts on NEAR then verify the settlement. The platform has processed more than $30 billion in volume across 35 blockchains.

Illia Polosukhin, co-founder of NEAR Protocol, said the damage was limited to USDT on the BNB Smart Chain. The NEAR token, the core protocol and other applications on the network were untouched.

Eleven networks, including BSC, Polygon, TON and Scroll, remained restricted for roughly another 12 hours while repairs were completed. The main service and the official website near.com resumed about an hour after the vulnerability was patched.

The NEAR token slipped about 6% in the hours after the news broke, trading near $4.95 before settling around $4.81, according to the report.

How rare is a full recovery?

Full recoveries remain uncommon in the industry, but NEAR Intents is not the only project to pull one off:

• Euler Finance's attacker returned the final $31 million from a $197 million hack in March 2023 after negotiations, leaving the protocol with more than $177 million in recovered assets.
• In July 2025, the GMX exploiter returned about $37.5 million after accepting a 10% white-hat bounty.

The NEAR Intents team had promised full reimbursement to users even before the funds came back. The incident stands out as one of the few hacking cases in crypto this year that concluded with the money returned.

The episode may sharpen the argument for rapid identification, open communication channels and time-boxed repayment ultimatums as the industry's most effective post-exploit playbook — and the project now faces the task of demonstrating that the patched Omni infrastructure can hold across all 35 supported chains.