'We Have Identified You, Sir': NEAR Intents' $3.8 Million Came Back Within a Day of the Ultimatum

On Thursday morning the on-chain investigator ZachXBT flagged unusual outflows from a BNB Chain hot wallet belonging to NEAR Intents, and traced the money to KuCoin and across a bridge to Bitcoin, more than $3.8 million in all. CoinDesk had it at 10:18 Eastern. By then NEAR Intents had paused deposits and withdrawals on eleven networks: BNB Smart Chain, Polygon, TON, Optimism, Avalanche, Stellar, Monad, X Layer, ADI, Scroll and Plasma. Its explanation was that "the incident was caused by a bug in the way its Omni deposit and withdrawal system interacted with the NEAR Intents smart contract," that "the contract-side vulnerability has since been patched," and that affected funds would be reimbursed in full.

Friday afternoon the same team said it was done. "The funds from the $3.8M NEAR Intents hack were sent back in full," general manager Alex Shevchenko posted. "We are stopping the investigation. Please use bug bounties instead of disrupting the services." The Crypto Times puts the recovery at 14:30 UTC on October 2 and reports that about $2.95 million of it came back as 34.59 bitcoin, with the remaining $850,000 or so arriving by other routes. A transaction on BNB Chain from an address the explorer labels "Near Intents Exploiter 1" carried a message thanking the team for being "respectful, constructive, and cordial."

Two layers, one bug

NEAR Intents is not a single contract. Its documentation describes a settlement layer, the Verifier contract at intents.near, where "deposited tokens are credited to accounts in the contract's ledger" and "tokens leave the contract only on withdrawal through token bridges." Below that sit the bridges that actually hold assets on other chains and move them. When a user withdraws to another network, "the Verifier settles the withdrawal through the appropriate token bridge, delivering tokens to the destination address." The documentation adds that "Intents Technology does not custody these balances — control stays with the keys that can sign for each account."

Omni is one of those bridges, and it is NEAR's own. The Omni Bridge repository, maintained by the Near-One organization, describes a multi-chain bridge built on NEAR's Chain Signatures and a multi-party computation service; transfers out of NEAR are signed that way, and transfers in from BNB Chain and several EVM networks are verified through Wormhole. Its security policy points to a bug bounty on HackenProof for "NEAR intents bridges," which is the program Shevchenko's parting line refers to.

What the two statements together describe is a disagreement between the layers. The ledger said one thing about a balance and the bridge released another, and the gap was paid out of the bridge's BNB Chain hot wallet in USDT. NEAR co-founder Illia Polosukhin, posting on X Thursday, said the impact was limited to USDT on BNB Chain, that the core NEAR protocol and token were unaffected, and that the fix went in within an hour of detection. "All of the affected users will be compensated in full," he wrote, and: "At this scale, we have to hold ourselves to a higher security standard." The Desk has not seen a technical post-mortem, and nothing published so far says what the bug was in code terms, which contract was patched, or which side of the ledger-bridge seam was wrong.

Related NEAR Intents Holds $503,000 of the $50 Million It Turned Away

The ultimatum

The part of this that will be remembered is Friday's post. "We have identified you, sir," Shevchenko wrote, publishing return addresses on Bitcoin, EVM chains and Solana and giving the person 48 hours. "You know better than most how responsible disclosure works — this is the last window to use it. After 48 hours, that window closes." Crypto Briefing and TechFlow both report that the incident had been referred to law enforcement. No bounty was offered in the post, and none has been announced since.

Asked afterward how the team had identified the person, Shevchenko replied: "No. We dropped the investigation already." He credited the work to the internal team, and Polosukhin said SHIELD, the screening layer NEAR Intents described two days earlier in the context of the Bitget theft, had assisted. The person was identified, by the team's account, in under 24 hours. ZachXBT's early trace through KuCoin, an exchange with account identification, is one obvious route to a name; the Desk is noting it as an inference, not reporting it as the method.

Three days, two postures

This is the second NEAR Intents story on this desk in three days, and the two sit oddly together. On Tuesday the team was explaining how SHIELD had declined to quote more than $50 million of swaps linked to the Bitget theft, holding $503,000 of it mid-swap. On Thursday its own bridge paid out $3.8 million it should not have, and the screening layer's contribution, by the team's account, was to the manhunt rather than the prevention. That is not a contradiction. SHIELD watches what comes in from other people's hacks; a ledger-bridge mismatch is a flaw in the house. But a protocol that has spent a week describing itself as the place stolen money cannot pass through has now had to ask for its own back, and got it, on terms it will not describe.

The posture on the money is clear and creditable: users made whole regardless, by Polosukhin's commitment on day one. The posture on the facts is not. There is no post-mortem, no statement of what was patched, and a flat refusal to say how the person was found. "We dropped the investigation already" closes the question of attribution, and the request to "use bug bounties instead of disrupting the services" reframes a theft as a disclosure that took the wrong door. Whether the person who took $3.8 million and gave it back after being named is a researcher or a thief who ran out of road is not something the public record can settle, because the people who could settle it have said they will not.