NEAR Protocol

Omni

ZachXBT

CoW Protocol

<h3 id="tldr">TLDR</h3>
<ul>
 <li>General Manager Alex Shevchenko of NEAR Intents announced the complete recovery of approximately $3.8 million stolen during an October 1 security breach.</li>
 <li>A vulnerability was discovered in the interaction between NEAR Intents’ Omni deposit-withdrawal infrastructure and its underlying smart contract.</li>
 <li>Operations were temporarily suspended across 11 blockchain networks, including BNB Chain, Polygon, TON, and Avalanche, as teams responded to the incident.</li>
 <li>Blockchain forensics tracked the stolen assets moving through a BNB Chain hot wallet, the KuCoin exchange, and ultimately to a Bitcoin bridge.</li>
 <li>NEAR Protocol’s main blockchain infrastructure and its native cryptocurrency remained unaffected throughout the incident.</li>
</ul>
NEAR Intents has successfully recovered the entire $3.8 million taken during a security breach that occurred on October 1. The protocol’s General Manager, Alex Shevchenko, announced the complete fund recovery following an intensive 48-hour period after the attack.
<div class="embed-x">
 <blockquote class="twitter-tweet">
 The funds from the $3.8M NEAR Intents hack were sent back in full.
 We are stopping the investigation.
 Please use bug bounties instead of disrupting the services.
 — Alex Shevchenko <img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f1fa-1f1e6.png" alt="🇺🇦" style="height: 1em; max-height: 1em;"> (@AlexAuroraDev) <a href="https://x.com/AlexAuroraDev/status/2106049685928677585?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 2, 2026</a>
 </blockquote>
</div>
Before the assets were returned, the protocol had publicly committed to compensating all impacted users in full. Consequently, the fund recovery primarily impacts NEAR Intents’ internal finances rather than representing an outstanding liability to its user base.
<h3 id="technical-breakdown-of-the-vulnerability">Technical Breakdown of the Vulnerability</h3>
The security flaw originated from a defect in the way NEAR Intents’ Omni deposit-withdrawal system communicated with its smart contract infrastructure. Technical analysis identified the vulnerability on the contract layer itself.
<div class="embed-x">
 <blockquote class="twitter-tweet">
 <img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f6a8.png" alt="🚨" style="height: 1em; max-height: 1em;">LATEST: NEAR Intents’ $3.8M hacker has RETURNED every dollar.
 Less than 24 hours after NEAR Intents publicly identified the alleged exploiter and gave them 48 hours to return the funds, the attacker sent the full $3.8M back.
 The hacker also left an on-chain message… <a href="https://t.co/nb2kUTCvfL" rel="noopener noreferrer nofollow">https://t.co/nb2kUTCvfL</a><a href="https://t.co/ks9V22Fet7" rel="noopener noreferrer nofollow">pic.twitter.com/ks9V22Fet7</a>
 — Coin Bureau (@coinbureau) <a href="https://x.com/coinbureau/status/2106243215523463421?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 3, 2026</a>
 </blockquote>
</div>
Illia Polosukhin, co-founder of NEAR Protocol, clarified that the exploit specifically targeted USDT tokens on the Binance Smart Chain. He noted that SHIELD, the platform’s artificial intelligence-powered security monitoring system, detected the suspicious transactions and automatically implemented protective measures.
Development teams deployed a patch addressing the contract vulnerability approximately one hour after detection. However, as a precautionary measure, deposit and withdrawal functionality remained disabled across multiple networks for nearly 12 additional hours while comprehensive security audits were completed.
The temporary suspension impacted 11 blockchain ecosystems: BNB Chain, Polygon, TON, Optimism, Avalanche, Stellar, Monad, Scroll, and Plasma. NEAR Protocol emphasized that its foundational blockchain architecture and native digital asset were never compromised during the security event.
<h3 id="following-the-digital-money-trail">Following the Digital Money Trail</h3>
Blockchain security analysts traced the suspicious transactions back to infrastructure connected with the HOT Bridge treasury on BNB Chain. Security researcher ZachXBT separately identified anomalous fund movements originating from a BNB Chain address associated with NEAR Intents.
Forensic analysis revealed the stolen assets were routed through the KuCoin cryptocurrency exchange before being converted and transferred via a bridge to the Bitcoin network. Available evidence indicates the NEAR blockchain’s core infrastructure was never directly compromised.
Throughout the recovery operation, the wallet controlling the stolen funds transmitted small quantities of ETH and BNB tokens to a designated recovery address. Each transaction contained embedded messages requesting Signal communication channel information.
Shevchenko subsequently published three distinct recovery wallet addresses for Bitcoin, BNB Chain, and Solana respectively. He established a 48-hour ultimatum for the suspected perpetrator to voluntarily return the misappropriated funds.
<blockquote>
 In his public statement, Shevchenko declared, “We have identified you, sir,” characterizing the deadline as a limited opportunity for responsible disclosure. He has not revealed the alleged perpetrator’s identity or shared documentation supporting the claimed identification.
</blockquote>
By October 2, the Bitcoin recovery wallet had received approximately 34.59 BTC. Complete fund restitution across all three designated addresses was verified shortly thereafter.
NEAR Intents filed formal reports with law enforcement agencies and collaborated with cybersecurity specialists to track the stolen digital assets. While a comprehensive incident analysis has been announced, it remains unpublished at this time.
Polosukhin identified an emerging trend of cyberattacks leveraging artificial intelligence capabilities, citing Bitget, MetaMask, and Lido as additional recent victims. MetaMask verified a separate infrastructure breach on October 1, while Lido acknowledged a security compromise affecting its Ethereum validation infrastructure.
Bitget continues addressing the consequences of a $387 million security breach from September 24, with investigators tracking laundered funds through CoW Protocol and Chainflip. NEAR Intents characterized this as its first significant security incident since platform inception, noting the service currently processes over $4 billion monthly.
According to the most recent communications, NEAR Intents has verified the complete $3.8 million recovery and restored the majority of services across all previously affected blockchain networks.
The post <a href="https://blockonomi.com/attacker-returns-funds-after-near-intents-issues-48-hour-recovery-deadline/" rel="noopener noreferrer nofollow">Attacker Returns Funds After NEAR Intents Issues 48-Hour Recovery Deadline</a> appeared first on <a href="https://blockonomi.com" rel="noopener noreferrer nofollow">Blockonomi</a>.

Attacker Returns Funds After NEAR Intents Issues 48-Hour Recovery Deadline

Table of Contents

Blockonomi

Other articles published on Oct 3, 2026

Join our free newsletter for daily crypto updates!