NEAR Intents Secures Complete Recovery of Stolen $3.8M Through Rapid Identification

Vulnerability Exploitation and Service Suspension

The NEAR Intents protocol experienced a significant security breach on Thursday when approximately $3.8 million in user funds were compromised. The vulnerability stemmed from a flaw in the interaction between the Omni deposit and withdrawal infrastructure and the NEAR Intents smart contract system. Upon detecting the unauthorized access, the protocol’s operators immediately suspended services to prevent further exploitation and contained the incident’s scope.

NEAR Intents initiated a comprehensive investigation into the breach while maintaining transparency with its user base about the nature and scale of the incident. The protocol committed to fully compensating all affected users regardless of the outcome of recovery efforts, setting an important precedent for user protection in the decentralized finance sector.

Unconventional Identification Leads to Complete Fund Return

NEAR Intents’ response to the security incident diverged from typical breach protocols. Rather than engaging in prolonged blockchain forensics or legal proceedings, the team successfully identified the individual responsible for stealing the funds. The protocol then took the unusual step of issuing a public ultimatum, demanding the return of all stolen assets within 48 hours under the framework of responsible disclosure—a mechanism traditionally used to give security researchers reasonable time to report vulnerabilities through proper channels before public disclosure.

The strategy proved remarkably effective. The identified exploiter complied with the demand, returning the complete $3.8 million to NEAR Intents by Friday. General manager Alex Shevchenko announced the successful recovery on X, confirming that all stolen funds had been fully restored and that the investigation would be discontinued. In his announcement, Shevchenko appealed to the security research community to use the platform’s bug bounty program for future vulnerability reporting rather than conducting unauthorized testing that disrupts services for users.

Recovery and Market Implications

Blockchain investigator ZachXBT provided additional details regarding the movement of stolen funds, revealing that the assets had been transferred to the KuCoin exchange and subsequently bridged to Bitcoin before being recovered. This routing suggests the exploiter attempted to convert and relocate the assets across different blockchain networks to obscure their origin and complicate recovery efforts—a common approach in cryptocurrency theft cases.

The incident demonstrates that identification remains the most valuable first step in cryptocurrency theft recovery, often proving more effective than technical countermeasures alone. NEAR Intents’ rapid response—from breach detection to complete fund recovery—showcases how transparent communication and swift investigation can successfully resolve security incidents while maintaining user confidence. The protocol’s commitment to fully compensating affected users, combined with the successful recovery of stolen assets, positions it as a model for effective incident management in decentralized finance. This successful resolution demonstrates that rapid protocol response and transparent communication can protect user funds and maintain ecosystem trust—a critical example for the broader cryptocurrency market as it matures.

Source: NEAR Intents, via Cointelegraph. Not financial advice.