$3.8 Million Returned: NEAR Intents Says All Stolen Assets Are Back

By Kevin · 2026-10-03 · News

Oct. 3 (CandyPulse) — It's the ending crypto hack victims rarely get. NEAR Intents says the attacker behind this week's exploit has returned all of the roughly $3.8 million that was taken.

Key takeaways

NEAR Intents says the full $3.8 million stolen on Oct. 1 has been returned
The return followed a 48-hour ultimatum and on-chain negotiations
The exploit came from a flaw between NEAR's Omni deposit system and its contracts
The team says it will now end its investigation

What happened

On October 1, an attacker exploited a flaw in how NEAR Intents' Omni deposit-and-withdrawal infrastructure interacted with its smart contracts, taking about $3.8 million. The team paused operations across 11 blockchain networks, patched the bug and restarted services, while promising full compensation.

How the money came back

NEAR Intents gave the attacker 48 hours to send the funds to designated Bitcoin, BNB/Ethereum and Solana addresses.

What followed was a negotiation carried out partly on the blockchain itself. The attacker's address sent 1 BNB to the recovery address with a message asking to continue talks privately. After several hours of back-and-forth, the full amount was returned.

On October 3, NEAR Intents lead Alex Shevchenko confirmed that all the funds were back.

A familiar pattern

This isn't the first time an attacker has handed money back. In crypto, it's become a recognised playbook:

Step	What usually happens
1	The project traces the funds on-chain
2	It offers a deadline, sometimes with a "bounty" for returning funds
3	It threatens legal action and law enforcement involvement if the deadline passes
4	The attacker negotiates, often via on-chain messages

Public blockchains make stolen funds hard to spend quietly, especially once they touch exchanges, which gives projects real leverage.

What it means for users

With the funds returned, users who were affected should see the issue fully resolved. As always, follow official NEAR Intents channels for any final details, and ignore messages offering to help you "claim" funds.

Why it matters

A quick patch, a clear deadline and a full recovery within two days is about as good an outcome as a DeFi exploit can have. It won't erase the risks of cross-chain systems, but it shows how fast, transparent responses can turn a crisis around.

This article is for information only and is not financial advice.