NEAR Intents Says Exploiter Returned Full $3.8M After 48-Hour Ultimatum
NEAR Intents recovered the roughly $3.8 million taken in an Oct. 1 exploit of its Omni deposit infrastructure and closed its investigation, after naming the attacker and setting a 48-hour deadline.
Why it matters
The full return, about 14 hours after the public ultimatum, ended the recovery effort without law enforcement action, and the team said it was stopping the investigation. The timing put the exploit days after Bitwise's NEAR ETF began trading on NYSE Arca on September 29 under the ticker NRR, which CryptoSlate reported had drawn $35.5 million on day one and more than $50 million by September 30.
Where the sources disagree
NEAR token drop after the exploit
plunged 7.5% within minutes to a low of $4.76
U.Today
fell 8% to $4.91 over 24 hours
CoinGape
fell about 10% to $4.86
CryptoSlate
Outlets report different magnitudes and reference points for the post-incident fall in NEAR, from 7.5% within minutes to about 10% to $4.86, while CoinGape also cites an 8% fall to $4.91 over 24 hours.
Figures that do not reconcile
Found by comparing the numbers in the reports automatically. They are differences, not yet confirmed to be about the same thing.
amount taken (near)
7.5%
U.Today
8%
CoinGape
U.Today reports 7.5%, CoinGape reports 8% (6% apart).
Key facts
A bug in the interaction between NEAR Intents' Omni deposit and withdrawal infrastructure and its smart contract let an attacker drain about $3.8 million on October 1.
3,800,000 USDReported by Bitcoin.com News
Blockchain data reviewed by Unchained shows a BNB Chain address documented as the HOT Bridge treasury address collected about 3.87 million USDT.
3,870,000 USDReported by Unchained
ZachXBT said the stolen funds were transferred to KuCoin and bridged into bitcoin.
Reported by Bitcoin.com News
NEAR Intents general manager Alex Shevchenko said on October 2 that the team had identified the attacker and gave them 48 hours to return the funds under responsible disclosure, posting bitcoin, BNB/Ethereum and Solana addresses to receive them.
48Reported by Cointelegraph
Shevchenko wrote on X that the funds from the $3.8 million hack were sent back in full and that the investigation was stopping.
3,800,000 USDReported by Cointelegraph
The bitcoin address Shevchenko listed received about 34.6 BTC in several transfers between 14:31 and 15:05 UTC on October 2, which onchain researcher Kuncoro estimated at about 78% of the loss.
34.6 BTCReported by Unchained
The NEAR token fell 7.5% to a low of $4.76 in the minutes after the incident became public, according to U.Today.
7.5 %Disputed figureReported by U.Today
What happened
NEAR Intents, the cross-chain trading protocol built on NEAR, halted services on October 1 after a bug in how its Omni deposit and withdrawal infrastructure interacted with the NEAR Intents smart contract let an attacker drain about $3.8 million. The protocol said the contract-side flaw was patched, made the roughly 11 networks it bridges to, including BNB Chain, Polygon, TON, Optimism and Avalanche, unavailable for deposits and withdrawals for about 12 more hours while the Omni layer was repaired, and pledged full compensation. Unchained reviewed blockchain data and found a BNB Chain address listed in NEAR Intents documentation as the HOT Bridge treasury collected about 3.87 million USDT; Unchained's reconstruction, relayed by Bitcoin Insider, put the five large withdrawals between roughly 7:54 p.m. ET Wednesday and 2:08 a.m. ET Thursday at about $35,000 to $1.5 million each. Onchain investigator ZachXBT said the funds moved to KuCoin and were bridged into bitcoin. General manager Alex Shevchenko said on Friday that the team had identified the person responsible and posted bitcoin, BNB/Ethereum and Solana addresses for the return, telling the attacker they had 48 hours under responsible disclosure before that window closed. Later the same day he wrote that the funds were sent back in full and that the investigation was stopping; an onchain message attached to a transaction read 'We've returned all the funds, we were in the wrong' and thanked the NEAR team. Onchain researcher Kuncoro found the listed bitcoin address took in about 34.6 BTC between 14:31 and 15:05 UTC Friday, worth about 78% of the loss according to Kuncoro; Shevchenko replied that the remainder came back but did not say how. NEAR co-founder Illia Polosukhin said the team identified the responsible party in under 24 hours and got the funds back at 14:30 UTC Friday. Unchained reported the exploit on October 1 as a loss of about $3.8 million without saying whose funds were lost, and NEAR Intents did not name the affected contract.
How the story developed
- Update
Test-sized transfers begin, followed by five large withdrawals from the HOT Bridge treasury
Unchained's reconstruction, relayed by Bitcoin Insider, puts small test transfers on Wednesday afternoon and five large withdrawals between roughly 7:54 p.m. ET Wednesday and 2:08 a.m. ET Thursday, ranging from about $35,000 to $1.5 million, loss denominated in USDT and centred on a BNB Chain contract.
- Official statement
NEAR Intents announces the exploit, pauses services and pledges full compensation
Posted at about 8:53 a.m. ET, the team said the contract-side flaw was patched, core services should resume within about an hour, and 11 networks would go without deposits and withdrawals for roughly 12 more hours.
- First report
First report by Bitcoin.com News
NEAR Intents Bug Sends $3.8M Racing Across Crypto Networks
- Update
ZachXBT traces stolen funds to KuCoin and a bridge into bitcoin
The onchain investigator named a BNB Chain address that received the funds; CoinDesk reported the team also notified law enforcement and hired security firms to trace the money.
- Independent corroboration
Independently corroborated by Unchained
NEAR Intents Pledges Full Compensation After a Bug Lets an Attacker Drain $3.8 Million
- Update
Shevchenko names the attacker and sets a 48-hour deadline
He posted bitcoin, BNB/Ethereum and Solana addresses for the return, wrote 'We have identified you, sir', and framed it as the last window for responsible disclosure.
- Update
About 34.6 BTC reaches the listed bitcoin address
Blockchain data shows several transfers into Shevchenko's bitcoin address between 14:31 and 15:05 UTC, which Kuncero valued at about 78% of the loss.
- Resolution
Full return announced and investigation closed
Shevchenko wrote that the funds were sent back in full and the investigation was stopping; a transaction note to the BNB/Ethereum address read 'We've returned all the funds, we were in the wrong.' Polosukhin said the funds were back in full at 14:30 UTC.
How coverage built up
Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.
- 1 Oct 2026, 13:47 UTC: Bitcoin.com News, official — 1 independent source, 1 reports
- 1 Oct 2026, 14:13 UTC: Unchained — 2 independent sources, 2 reports
- 1 Oct 2026, 14:18 UTC: CoinDesk — 3 independent sources, 3 reports
- 1 Oct 2026, 15:27 UTC: U.Today — 4 independent sources, 4 reports
- 1 Oct 2026, 15:40 UTC: CoinGape — 5 independent sources, 5 reports
- 1 Oct 2026, 17:00 UTC: Crypto News (CryptoNews.net) — 6 independent sources, 6 reports
- 1 Oct 2026, 17:49 UTC: Crypto.News — 7 independent sources, 7 reports
- 1 Oct 2026, 21:30 UTC: CryptoSlate — 8 independent sources, 8 reports
- 2 Oct 2026, 02:02 UTC: Cointelegraph — 9 independent sources, 9 reports
- 4 Oct 2026, 13:01 UTC: Decrypt — 10 independent sources, 13 reports
Affected entities
Also mentioned: Polygon, Toncoin, Avalanche, Optimism, Ethereum, Solana, United States
Original sources
Related events
KuCoin Web3 Wallet Routes Eligible Tokenized Asset Swaps Through PancakeSwap X
Bitcoin Insider reported that KuCoin Web3 Wallet Swap now supports PancakeSwap X as an execution option for eligible tokenized asset swaps on BNB Smart Chain.
KuCoin Announces Multiple Service Updates Including API Symbol Changes, New Listings, and Trading Schedule in September 2026
KuCoin rolled out a series of service updates in September 2026 including ticker symbol changes, new token listings, trading pair launches, maintenance closures, and a VIP migration program.
KuCoin Launches Copy Rush Copy Trading Campaign With BTC, iPhone and Trial Fund Rewards
KuCoin started a Copy Trading task campaign running to October 18, 2026, where eligible users earn lucky draw chances for prizes including 0.002 BTC and an iPhone 18 Pro Max.
KuCoin Earn starts Week 135 of Friday yield offers on USDT, BTC and DOT
Bitcoin Insider reported that KuCoin Earn's Week 135 event opened at 08:00 UTC on October 2, 2026, with products advertised at up to 9% APR and extra rewards tied to KCS holdings.
Bitcoin Insider reports KuCoin CENT listing with 17,241,380 CENT giveaway
Bitcoin Insider reported that KuCoin listed Incentiv (CENT) on October 12, 2026 and ran a 17,241,380 CENT giveaway for traders.
KuCoin Sets 7,638,586 UOS Prize Pool For Two-Stage Trade And Learn Campaign
Bitcoin Insider reports KuCoin is running a two-stage Ultra (UOS) trade and learn campaign with a 7,638,586 UOS prize pool running from September 28 to October 19, 2026.