TL;DR:
- The protocol recovered the entire $3.8 million drained well ahead of the deadline set for October 4, 2026.
- The return transaction on BNB Chain was confirmed at 16:15:28 UTC on October 2, 2026, featuring an input message from the attacker.
- The designated Bitcoin recovery address logged 34.59 BTC between 14:31 and 15:05 UTC, valued at roughly $2.95 million based on prevailing market rates.
The NEAR Intents team successfully recovered the $3.8 million drained in a recent security breach, formally concluding its internal investigation this Friday, October 2.
The funds from the $3.8M NEAR Intents hack were sent back in full.
We are stopping the investigation.
Please use bug bounties instead of disrupting the services.
— Alex Shevchenko 🇺🇦 (@AlexAuroraDev) October 2, 2026
Platform CEO Alex Shevchenko confirmed the full recovery of funds via a social media announcement. The executive noted that the capital was returned prior to the deadline originally scheduled for Sunday, October 4, 2026.
The restitution wrapped up ahead of schedule after designated recovery addresses were set up across the Bitcoin, BNB Chain/Ethereum, and Solana networks. Shevchenko did not disclose the technical methods deployed to trace the perpetrator, nor did he confirm whether law enforcement agencies were involved in the process.
Meanwhile, Illia Polosukhin, co-founder of NEAR Protocol, stated that tracking the attacker was accomplished in under 24 hours following the incident. According to Polosukhin’s statements, the tracing effort leveraged SHIELD, an AI-powered security layer, paired with direct internal forensic analysis.
The capital was fully restored around 14:30 UTC on October 2, 2026, at which point the engineering team closed the matter. Polosukhin did not release technical specifics regarding the security tool’s internal mechanics during the recovery workflow.
On-Chain Tracing and Confirmation on BNB Chain
On BNB Chain, blockchain explorers documented a confirmed transfer at 16:15:28 UTC originating from a wallet labeled “Near Intents Exploiter 1”. The on-chain record included an explicit message embedded within the transaction input data, in which the sender acknowledged the incident and expressed appreciation for the team’s professional conduct during the return process.
The transaction is recorded on-chain under hash 0x3b9b3cc9e53ae9ad97850c2b8f3e19259d97834210858f467bfc377f2aeeb3af. While the embedded message does not independently verify the civil identity of the sender, the fund movements aligned directly with the recovery reported by leadership.
On-chain researcher Kuncoro audited the three public designated refund addresses. According to the analyst’s data, the Bitcoin address received 34.59 BTC during a window between 14:31 and 15:05 UTC on October 2, 2026.
At a benchmark price of approximately $85,200 per coin, that transfer accounted for nearly $2.95 million. The address tied to BNB Chain and Ethereum showed smaller balances of 1.04 BNB and 0.30 ETH, while the Solana address registered no active balance, indicating the remaining $850,000 was settled through alternative channels.
Shevchenko publicly endorsed Kuncoro’s calculations, though NEAR Intents has not published an independent audited breakdown for each individual inbound transfer.
Following the asset recovery, the protocol reiterated its call for researchers to rely on official bug bounty frameworks to disclose security flaws rather than compromising production environments.
As its next operational milestone, NEAR Intents plans to restore paused components across its cross-chain routing infrastructure starting next week, once internal audits of the affected smart contracts are finalized.
