NEAR Intents says it has identified the individual responsible for a $3.8 million exploit against the protocol and has given them 48 hours to return the stolen funds before the matter moves toward formal escalation.

The team disclosed the deadline publicly, framing the two-day window as a final opportunity for the attacker to negotiate restitution before the case is handed to the relevant parties for pursuit. The identification claim suggests the protocol's internal investigation, assisted by on-chain tracing, has progressed from forensic analysis to attribution — a step that often precedes law-enforcement referrals or civil recovery actions in comparable incidents.

The ultimatum follows a now-familiar playbook in decentralized finance. Protocols that can credibly link an exploit to a specific person or entity frequently offer a fixed-term amnesty window: return the bulk of the funds, keep a negotiated bounty, and avoid prosecution. When the window closes without restitution, matters typically shift to courts, chain-analytics firms, and enforcement channels — a slower and less certain path for recovery.

For NEAR Intents, the operational calculus is straightforward. A voluntary return of $3.8 million would cap the incident's balance-sheet damage at transaction costs and remediation work. A refused offer extends the timeline indefinitely and adds legal expenditure, while the stolen funds remain traceable but not necessarily recoverable, particularly if moved through mixers or cross-chain bridges.

Attribution claims of this kind also carry evidentiary weight in follow-on proceedings. If the 48-hour deadline lapses, a documented identification — timestamped, published, and backed by on-chain records — strengthens any subsequent filing, whether criminal or civil, and gives counterparties such as exchanges a basis to freeze deposits tied to the attacker's addresses.

The next 48 hours will determine whether the incident resolves as a negotiated restitution or becomes a prolonged recovery effort, with the deadline's expiry marking the point at which NEAR Intents must make its escalation strategy concrete.