NEAR Intents Hack: Hacker Returns $3.8M After 48-Hour Ultimatum

The NEAR Intents hacker returned the $3.8 million stolen on October 1, 2026, announced Alex Shevchenko, CEO of the crypto exchange protocol, on October 2 on X. The return happened before the expiration of the 48-hour ultimatum set to the attacker, whom the leader claimed to have identified. Cointribune cross-checked this announcement with Bitquery’s on-chain analysis: about one fifth of the loot passed through NEAR Intents itself during the theft.

How did NEAR Intents recover $3.8M in less than 48 hours?

The crypto hacker sent back the funds on October 2, before the ultimatum expired, Alex Shevchenko wrote on X. The announcement comes a week after the Bitget hack, which NEAR Intents said it blocked part of the fund transfers from.

The $3.8M NEAR Intents hacking funds were fully returned. We are stopping the investigation.

Alex Shevchenko, CEO of NEAR Intents, on X, October 2, 2026

According to NEAR Intents on X, a bug in the interaction between the Omni layer of deposit and withdrawal and the main smart contract (the code holding the funds) enabled the theft. The service suspended its operations, promised full compensation, and alerted authorities. Our first article about the NEAR Intents hack details these announcements.

Bitquery’s analysis details the sequence: 3,865,000 USDT withdrawn from a vault on BNB Chain, in five withdrawals over about six hours, after two tests of 10 and 11 USDT.

However, this figure does not tell the whole story. The difference with the $3.8 million announced by NEAR Intents could come from the last withdrawal of 35,000 USDT. Moreover, the detailed report promised on October 1 has not been published at this stage.

Where did the funds go after the crypto hack?

As of October 1 at 2:30 PM UTC, 76% of the loot was converted into 34.69 BTC distributed across four wallets, and 21% ($802,000) had reached KuCoin deposit addresses, according to Bitquery. Investigator ZachXBT also reported a passage through KuCoin, then a transfer to Bitcoin.

Another fact noted by Bitquery: about $822,000 was exchanged via NEAR Intents during the theft, automated exchanges that do not reveal what the protocol knew, nor when.

Why did the crypto hacker return the funds?

The exact reason has not been publicly established. NEAR Intents claimed to have identified the attacker and gave them 48 hours to practice responsible disclosure, meaning reporting a crypto vulnerability rather than exploiting it, in a message on X.

You know better than most people how responsible disclosure works: this is the last window to use it. After 48 hours, this window closes.

Alex Shevchenko, CEO of NEAR Intents, on X, October 2, 2026

A message attached to a transaction, shared by Alex Shevchenko and apparently from the attacker, acknowledges wrongdoing and invites using the bug bounty programs (rewards for reporting vulnerabilities). The crypto hacker’s identity and the identification method have not been disclosed either.

Is the NEAR Intents hack connected to the Bitget one?

At this stage, no public evidence establishes that the two crypto hacks were carried out by the same actor. Bitget suspects a North Korean group for its September 24 attack, without independent confirmation.

NEAR Intents says it blocked more than $50 million in transfers attempted by crypto wallets linked to Bitget: $503,000 frozen in execution and $166,000 passed, according to Alex Shevchenko.

NEAR Intents hack: what we know and what remains unknown

Item	Information
Withdrawals	Night of September 30 to October 1 (UTC), $3.87M in five withdrawals (Bitquery)
Ultimatum	48-hour deadline announced by Alex Shevchenko
Return	October 2, before deadline, announced by Alex Shevchenko
Attacker’s identity	Not public, identification method not detailed
Reason for the return	Not publicly established
Technical report	Promised, not published at the time of article writing
Link with Bitget	No public evidence at this stage

The sequel depends on a deadline still undetermined: the detailed report promised by NEAR Intents. It will reveal whether this hack remains an isolated incident or reveals a weakness in its cross-chain infrastructure, which covers 35 blockchains, after the crypto hacks in September.