Hacker returns full $3.8m after NEAR Intents exploit

The hacker behind the NEAR Intents exploit has returned the full $3.8 million. That gives the incident, which began with a flaw in the Omni deposit and withdrawal system, a remarkable ending. First the attacker makes contact with the team via an onchain message. Then all the stolen funds are sent back and the hacker admits to having been in the wrong.

Exploit initially costs NEAR Intents $3.8 million

The incident starts at NEAR Intents, a multichain service that lets users and AI agents execute transactions between different blockchains.

A flaw related to the Omni deposit and withdrawal system makes an exploit possible. Around $3.8 million disappears in the process.

NEAR Intents then steps in and pauses deposits and withdrawals for several networks. These include BSC, Polygon, TON, Optimism, Avalanche, Stellar, Monad, LayerX, Adi, Scroll and Plasma.

The team fixes the flaw in the contract and promises to fully compensate affected users. At the same time, security firms are brought in to trace the stolen funds and the incident is reported to the authorities.

The team then also opts for a direct approach to the suspected attacker. Alex Aurora gives the hacker a 48 hour window to cooperate, return the funds and potentially qualify for a bounty.

Hacker reaches out to NEAR directly

Not long afterwards, a response does indeed arrive.

NEAR Intents’ recovery wallet receives 1 BNB carrying a striking onchain message: “Willing to cooperate, reply with your Signal so contact is possible.”

The sending address is labelled “NEAR Intents Exploiter 1” on BNBScan. According to the shared information, the address is also linked to the exploit by blockchain investigator ZachXBT.

That appears to shift the situation from a classic hunt for stolen crypto to negotiations over returning the funds.

In the end, it does not take long for results to follow.

The full $3.8 million comes back

Less than 24 hours after NEAR Intents publicly identifies the suspected attacker and sets a 48 hour deadline, the hacker sends the full $3.8 million back.

With the transaction, the attacker leaves another message. It reads: “We’ve returned all the funds, we were in the wrong.”

The hacker also thanks the NEAR team for the respectful and constructive way in which the return process was handled, and closes with the advice to always use bug bounties.

That gives an exploit which initially caused a loss of $3.8 million an exceptional outcome. All the stolen funds are back and, according to the shared information, NEAR then ends the investigation in light of the full recovery.

For users, that last point matters most: where NEAR Intents initially had to reckon with millions in lost funds and compensation for victims, the full amount was ultimately returned by the attacker itself.