NEAR Intents, the cross-chain swap protocol built on the NEAR blockchain, has stated that $3.8 million in funds taken during a recent exploit have been returned, according to a report by Altcoin Buzz.

The disclosure closes out, at least provisionally, one of the more closely watched security incidents involving NEAR ecosystem infrastructure in recent months. The protocol did not initially disclose the full mechanics of the return, and the announcement leaves open questions about whether the restitution came from the attacker directly, through a negotiated white-hat settlement, or by way of recovery efforts by security teams.

The $3.8 million figure represents the total value that the protocol previously attributed to the exploit. NEAR Intents operates as a bridging and intent-based swap service, allowing users to express desired asset outcomes across chains while relying on a network of solvers and custodial infrastructure to execute them. Incidents of this kind matter beyond the immediate loss: they test the operational resilience of the solver network, the custody arrangements that hold user assets mid-swap, and the protocol's ability to restore service without eroding user confidence.

An exploit followed by a full return of funds is the rarest outcome in decentralized finance security incidents. In most cases, exploited protocols recover only a fraction of stolen assets, either through blockchain forensics, exchange freezes, or negotiated bounties offered in exchange for the bulk of the loot. When funds come back in full, it often signals that the attacker concluded that laundering the assets was impractical — a judgment shaped by the traceability of the stolen funds, the scrutiny of on-chain analysts, and the legal exposure attached to identifiable movement of the assets.

For NEAR Intents specifically, the returned $3.8 million matters for operational continuity. The protocol's business model depends on users pre-funding swaps through its custody layer; any perception that those funds are vulnerable directly suppresses transaction volume. A full recovery allows the team to make affected users whole, a prerequisite for restoring the liquidity flows and solver participation that intent-based architectures require.

The announcement also lands at a moment of heightened attention on cross-chain infrastructure security. Bridge and interoperability protocols remain the most exploited category in decentralized finance by cumulative losses, and intent-based systems — which replace passive bridge liquidity with active solvers competing to fulfill user orders — have inherited many of the same custody risks. How a protocol responds to a breach, not merely whether one occurs, has become a key input for institutions evaluating which cross-chain rails to integrate.

NEAR Intents has not, per the available reporting, detailed a timeline for reimbursing affected users or described what technical or procedural changes it has implemented since the incident. Those details will shape the market's assessment of whether the recovery represents durable operational maturity or a fortunate one-off. Protocols that publish post-mortems, audits, and remediation timelines after exploits have historically regained transaction flow faster than those that treat incidents as public relations problems to be minimized.

The immediate financial impact of the incident now appears contained. The reputational and structural questions — about custody design, solver oversight, and incident response — will take longer to answer, and NEAR Intents' next audit publication or engineering post-mortem will offer the first concrete test of whether the protocol has converted this incident into hardened infrastructure.