
The address linked to the $3.8 million theft sent a message requesting communication on Signal, but did not return the funds.
The alleged perpetrator of the $3.8 million theft from NEAR Intents responded to Alex Shevchenko's ultimatum by sending 1 BNB and a message via blockchain, requesting a chat on the Signal app for trading.
AI-generated summary
NEAR Intents suffered theft of 3.87 million USDT from BNB Chain. Alex Shevchenko issued a 48-hour ultimatum for the return of the funds.
The address identified in the NEAR Intents theft responded to the ultimatum. On October 2 at 10:22 UTC, she sent 1 BNB to the restitution wallet published by Alex Shevchenko, with a message written in the transaction: âWilling to cooperate, reply with your Signal so contact is possible. » The team has not yet said whether it will follow through.
Key Points
The message starts from 0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37, the address of the theft on BNB Chain, already pointed out by ZachXBT
It arrives at 0xB18a1aEDfde8B70FD67012C9E9c7a088B4d0C0e7, one of three return addresses published overnight
1 BNB is not a refund: the $3.8 million did not come back
The 48-hour window opened by Shevchenko runs until October 4, around 0:18 UTC
A message, not a restitution
On the night of October 1-2, Alex Shevchenko, who runs NEAR Intents, wrote on X that he had identified the author of the theft. He gave him 48 hours to return the funds, and published three addresses: one in bitcoin, one common to BNB Chain and Ethereum, one on Solana. The tone was that of a final window of responsible disclosure. After this time, the window closes.
The response arrived about ten hours later, and it didnât respond. Transaction 0x865âŠfe10b moves 1 BNB, approximately $780 at the current rate, from the address through which the funds exited. The text travels through transaction data, the channel hackers sometimes use to trade without opening an account. The request is precise: a Signal identifier, to speak off-chain.
This is not the first sign of life from this address. This is the one that ZachXBT had designated in the hours following the exploit, and through which approximately 3.87 million USDT left the NEAR Intents vault on BNB Chain. The majority then went to bitcoin, a part to KuCoin, a crumb to Hyperliquid. Nothing about this journey is undone by the morning message.
The rest is played off-chain
A sending of 1 BNB does not say what the author intends to return, nor under what conditions. No bonus has been announced by the team. Shevchenko has not responded publicly as of this writing, and the NEAR Intents account has not posted anything since its October 1 statement. This press release promised a full refund for users and a detailed report. Both still hold, whether the contact is successful or not.
AI outlook â possibilities, not facts
Ultimatum ends October 4 at 0:18 UTC.
Very likely · Within days

The Fideuram subsidiary of Intesa Sanpaolo was the victim of a fraud against the president of 95 million euros. The scammers used WhatsApp and an AI voice clone to fool management. 53 million were recovered, the rest was converted into cryptocurrencies.

Two Dallas men, Damian Vielma and Jeremiah Clybourn, were arrested for an attempted armed burglary in San Jose. Posing as delivery men, they targeted cryptocurrency holders in the San Francisco Bay Area.

Two homejacking attempts aimed at stealing cryptocurrencies targeted the same couple in Saint-Jean-de-Védas near Montpellier, in April and September 2026. Three suspects aged 19, 30 and 38 were arrested during the second attempt after triggering the perimeter alarm. The first incident in April involved a 25-year-old fake armed delivery man, arrested in Marseille. The PNACO reports an increase in crypto-kidnappings in France with 135 cases since 2023.

A 24-year-old Amsterdam man, suspected of being an alleged leader of the cybercriminal group ShinyHunters, was arrested on September 15, 2026 in Amsterdam. Investigators found elements in his computer suggesting an attempt to incite two murders abroad. The group, active since 2019, is known for stealing data and demanding bitcoin payments, having targeted companies like Ticketmaster and AT&T.

Between September 15 and 20, 11.75 million XRP was stolen from 6,678 accounts linked to the D'CENT mobile application. Attackers used the AccountDelete function of the XRP Ledger to siphon funds after a private key compromise.

In Taverny, three hooded men kidnapped a family to extort cryptocurrencies based on tax data stolen from Waltio in January 2026. The targeted assets dated from 2024 and had declined significantly, limiting the loot to a few hundred euros. Six suspects were indicted, including three in pre-trial detention, and the alleged mastermind is believed to be a man imprisoned in Auxerre.