The NEAR Intents development team stated that they have identified the individual behind the $3.8 million theft that hit their protocol. This finding provides an update on the investigation since the breach first occurred on Thursday, Oct. 1, 2026, paving the way for asset recovery efforts.
NEAR Intents General Manager Alex Shevchenko directly confronted the suspect via an open message on the X platform. “We have identified you, sir,” Shevchenko wrote. He issued a 48-hour ultimatum for the perpetrator to return all stolen funds through a responsible disclosure route to prevent further escalation.
Shevchenko did not leave the perpetrator guessing about repayment methods. He publicly shared three separate wallet addresses specifically set up to receive the returned funds in Bitcoin, BNB, and Solana.
Trail of Funds to KuCoin
The revelation of the hacker’s identity came alongside fund flow reports from blockchain investigator ZachXBT. His on-chain analysis revealed that the exploiter transferred part of the funds to the KuCoin exchange and bridged another portion into the Bitcoin network.
The theft stemmed from a security flaw in the protocol’s core infrastructure. Prior to announcing the suspect’s identity, NEAR Intents management halted all network services to prevent the remaining assets from being drained.
The technical team shut down the system immediately upon detecting the bug. The vulnerability resided in the interaction between Omni’s deposit and withdrawal infrastructure and NEAR Intents’ smart contracts, a weakness the hacker subsequently breached.
User Reimbursement
The early October incident disrupted protocol operations and left users in limbo. Amid ongoing negotiations and recovery efforts, management pledged to fully reimburse users affected by the exploit.
The user compensation policy took effect immediately without waiting for the hacker’s ultimatum deadline to expire. The move safeguards users while the team continues to pursue those responsible for the multi-million-dollar attack.
Reported by Cointelegraph.
Previously: Hacker Breaches NEAR Intents Infrastructure for $3.8M - Cross-Chain Services Completely Frozen
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
