How NEAR Intents Identified a Suspect and Got Its Stolen Funds Back

NEAR Intents, a service that combines blockchains into a shared liquidity layer for cross-chain swaps, halted after an exploit with a reported loss of $3.8 million. Alex Shavchenko said the attacker targeted USDT on BNB Chain. The flaw was in asynchronous coordination: NEAR Intents recorded a deposit on NEAR before the assets had actually arrived. He characterized it as an interaction flaw in a complex multichain protocol, not a spoofing attack.

The team spotted the exploit when accounting checks found a mismatch between recorded deposits and assets in treasury contracts. It paused the contracts in about 40 minutes. The service normally handles roughly $200 million and one to three transactions per second per day, according to Shavchenko. Although the bug had been audited multiple times, auditors had not identified the relevant operating mode and sequence of actions. Different chains have different operating and security properties, he said, so some parts of the system were affected while others continued running.

Shavchenko said the team planned to compensate users in full from its own funds, taking responsibility for the protocol bug rather than assigning the loss to users. A security council of roughly six members reviewed public information from Web2 and Web3 sources alongside internal logs. About 12 hours after the exploit, NEAR Intents publicly asked the suspected attacker to return the funds to addresses on Bitcoin, BNB, Ethereum, and Solana, giving them 48 hours.

The investigation produced what Shavchenko called highly convincing evidence linking accounts used in the exploit to a particular person or people close to that person, but it did not establish who physically carried out the attack. He privately contacted someone connected to the evidence and asked for help preserving and sharing logs. The attacker also sent an on-chain message expressing willingness to cooperate. The team responded with a tweet encrypted to the attacker’s public key and directions to join a Signal group, which required the corresponding private key to access. Shavchenko stressed that the eventual return of the funds did not prove the suspected person was guilty or that the person communicating with the team was the attacker.

The team initially believed the funds remained on Ethereum, BNB, and Solana, but later found they had been converted to Monero. Some funds were tracked on Bitcoin, while Monero’s source-of-funds questions complicated handling the assets. Shavchenko described the incident as the ecosystem’s third recovery process and compared it with a public RIA Protocol case in April involving about $20 million, which also ended with funds returned after similar actions.

Shavchenko said NEAR Intents’ protections helped prevent funds from the $50 million BitGate hack from flowing into Zcash, though some funds were hacked directly onto Zcash and remain shielded. He said amounts and transaction timing can help connect tokens to a hack, but shielded Zcash is harder to analyze and he could not say it is fully traceable. Laura Shin noted that the protections worked mainly because the BitGate funds were on public blockchains. Shavchenko expects regulators to focus on privacy protocols’ entrances and exits if they cannot inspect activity inside them. He said illicit activity involving Monero is several times its market capitalization and estimated that a coin may be traded three to ten times among illicit actors; if illicit activity heavily penetrates Zcash, he expects regulators to pressure centralized exchanges to delist it, as they did with Monero.