Near Intents has recovered the full roughly $3.8 million taken in a Thursday exploit, according to general manager Alex Shevchenko. The cross-chain swap service said it had ended its investigation after the attacker returned the funds, following a public 48-hour ultimatum from the team.
Funds Returned After Public Warning
Shevchenko said the money was sent back in full on Friday, one day after he published cryptocurrency addresses for returning the stolen assets. In a message directed at the attacker, he wrote: “We have identified you, sir.”
The warning was presented as a final opportunity for responsible disclosure, in which a person reports a security vulnerability to a project rather than exploiting it. Shevchenko gave the attacker 48 hours to return the funds and asked them to use the project’s designated Bitcoin, BNB/Ethereum and Solana addresses.
An on-chain message linked to a transaction and shared by Shevchenko appears to have come from the exploiter. It said: “We’ve returned all the funds, we were in the wrong.” The message also thanked the Near team for its conduct during the process and encouraged others to use bug-bounty programs.
The original incident was reported by Decrypt.
What Happened to Near Intents
Near Intents halted its service on Thursday after identifying a flaw involving the way its Omni deposit and withdrawal layer interacted with its main smart contract. The weakness allowed the attacker to siphon funds from the system.
The project had said it would compensate users in full and reported the incident to law enforcement. Blockchain investigator ZachXBT said the stolen assets were transferred to KuCoin and then bridged to Bitcoin.
Near Intents is a cross-chain swap service. Users specify the transaction they want, while market makers compete to execute it across different networks. The service says it has processed more than $30 billion in swaps and supports 35 blockchains.
The returned funds mean the episode ended quickly, but it came during a particularly active period for the project. Two days before the exploit, Near Intents blocked a $50 million swap attempt connected to the hacker behind the approximately $387.5 million Bitget breach. Bitget and blockchain analytics firm Elliptic have attributed that breach to North Korea.
The incident also occurred days after Bitwise’s spot NEAR exchange-traded fund began trading. An ETF is an investment vehicle that tracks an asset or group of assets and trades on an exchange, although the source material does not link the fund’s launch to the exploit.
NEAR Market Picture
Moneyiar market data at 09:43 on October 5, 2026, showed NEAR Protocol at $5.0257894214. The token was up 5.21% over 24 hours and down 0.12% over seven days.
For comparison, Moneyiar data at the same time showed Plasma at $0.0953958683, up 0.1% over 24 hours and down 4.64% over seven days; Rain at $0.0121571707, down 2.4% and 3.25%, respectively; and FUNToken at $0.0079946419, down 0.55% over 24 hours but up 6.83% over seven days.
Shevchenko said the team was stopping its investigation after the money was returned. He also urged would-be discoverers of vulnerabilities to use bug bounties rather than disrupt services.
