Near Intents recovers all of the stolen $3.8 million

Return to sender. Near Intents has recovered all of the $3.8 million stolen while operating its cross-chain swap service. The funds were returned less than two days after Alex Shevchenko, the project's general director, publicly claimed that the team knew the identity of the attacker. Near Intents is now ending its internal investigation. However, a possible procedure carried out by the authorities remains separate from this decision.

Key Points

All $3.8 million stolen was returned less than two days after the attack

Alex Shevchenko had given the author of the exploit 48 hours to return the funds

A flaw in the interaction between the Omni layer and the main contract allowed the hijacking

Two days before, Near Intents blocked $50 million linked to the Bitget hack

Near Intents recovers stolen $3.8 million

“Funds from the NEAR Intents hack, amounting to $3.8 million, have been returned in full. We are stopping the investigation,” Alex Shevchenko announced on X.

The day before, the leader had published restitution addresses compatible with Bitcoin, the EVM Ethereum and BNB Chain networks, as well as Solana. His message was addressed directly to the attacker: “We have identified you, sir”. The team then gave him 48 hours to return the assets before continuing their efforts.

Alex Shevchenko presented this possibility as a last opportunity to follow a responsible disclosure procedure, which involves reporting a flaw to developers and going through a reward program rather than exploiting it.

A message attached to a transaction and presented as coming from the author of the hack then confirmed the restitution.

“We returned all the funds, we were in the wrong. »

Onchain message attributed to the author of the exploit and relayed by Alex Shevchenko – Source: Decrypt

The release also thanks the team for their cordiality and invites security researchers to use bug bounty programs. For his part, onchain investigator ZachXBT had followed part of the funds to KuCoin, before their conversion and transfer to Bitcoin. This passage through a centralized platform could facilitate the identification work, without alone proving the identity of the account user.

A gap between the Omni layer and the main contract

Near Intents had discontinued its service after detecting a defect in the way its deposit and withdrawal Omni layer communicated with its main contract. This weakness allowed the attacker to withdraw around $3.8 million.

The team reported the incident to the authorities and promised to fully reimburse affected users. The return of all funds now reduces the direct financial exposure of the protocol.

Near Intents allows assets to be exchanged between 35 blockchains. The user indicates the desired outcome, then different market makers compete to execute the trade. According to the service's data, more than $30 billion in swaps have been processed since its launch.

The incident comes after a busy week. Two days before the exploitation, Near Intents blocked a conversion attempt involving more than $50 million linked to the Bitget hack, estimated at $387.5 million. Bitget and analytics firm Elliptic linked this attack to North Korean actors.