NEAR Intents hacker has returned all $3.8 million in stolen funds following a 48-hour ultimatum issued by Aurora co-founder Alex Shevchenko. According to Shevchenko's latest statement, the attacker reached out and was willing to negotiate shortly after the warning, with the funds being fully recovered and the investigation subsequently stopped. The recovery represents one of the fastest exploit resolutions in recent crypto history, potentially the only case where all stolen funds were recovered within two days. Shevchenko's statement emphasized the importance of proper security channels, noting that "use bug bounties instead of disrupting the services" - suggesting the attacker may have defended their actions as legitimate security research intended for reporting to the team.
NEAR Intents, a cross-chain swap service built on NEAR Protocol, lost approximately $3.8 million to an exploit on October 1st involving USDT on BSC. The attacker exploited Omni's deposit and withdrawal interaction with the NEAR Intents smart contract, with Polosukhin specifically identifying USDT on BSC as the affected asset. The NEAR token fell 9% from $5.34 to $4.84 following the hack announcement, with the price touching the $4.75 area for a short while before recovering. According to Polosukhin, SHIELD detected behavior outside normal activity patterns, prompting the temporary pause while the Intents team identified and fixed the exact vulnerability within an hour of detection. The platform has confirmed it has patched the contract flaw and will compensate affected users in full, while also reporting the incident to law enforcement.
NEAR Protocol has extended its losses to 16% and broken below key trendline support despite the fund recovery, with the token hitting $4.00 and potentially targeting the next support zone at $4.00 or $3.50. According to AMBCrypto, this recovery has not boosted NEAR value amid broader market weakness, with the token's decline reflecting concerns beyond the single exploit. The broader crypto landscape shows concerning trends, as Q3 hack-related losses surged from $86 million at end-June to $742 million at end-September - representing nearly a 10x increase. Notably, over $1.25 billion has been lost since July, with North Korean threat actors flagged as the biggest players in recent attacks.
The NEAR Intents hack follows a concerning pattern of security incidents within the NEAR ecosystem. In April 2026, Rhea Finance, a decentralized finance hub on NEAR, lost $18.4 million in an exploit, according to QuillAudits, with initial estimates putting the damage at $7.6 million. Shevchenko then publicly confirmed that the attacker had been identified, though the attacker returned only 3.36 million USDC, 1.56 million NEAR, and roughly $4.4 million in Zcash (ZEC) among other assets. Tether froze about $3.29 million in USDT tied to the attack, leaving a shortfall of approximately $400,000 that the Rhea team committed to cover. The two exploits within six months raise questions about the ecosystem's security, but the Rhea case demonstrates that public warnings can precede large returns, potentially making identification threats a standard recovery tool across DeFi.
Deposits and withdrawals remain paused for approximately 12 more hours on 11 networks following the hack, including BNB Chain, Polygon, TON, Optimism, Avalanche, Stellar, Monad, X Layer, ADI, Scroll, and Plasma. NEAR Intents has promised a full technical report in the coming days. Security firms Mandiant and SlowMist continue assisting Bitget with forensic investigations, with the exchange scheduling remaining token and peer-to-peer withdrawal services to return October 2, 2026. Circle and Tether, issuers of USDC and USDT, have already frozen about $320,000 in stablecoins linked to the breach. The incident represents the second major exploit in the NEAR ecosystem this year, following Rhea Finance's $7.6 million loss in April.
