Oct 9, 2026 · 46 min
NEAR Intents traces a $3.8 million exploit to its suspected attacker
How NEAR Intents Identified a Suspect and Got Its Stolen Funds Back
The incident shows how a cross-chain protocol can detect fraud, compensate users, investigate stolen funds, and still confront hard limits around privacy and decentralization.
- 1A faulty asynchronous process let an attacker spoof USDT deposits, causing approximately $3.8 million in losses.
- 2NEAR Intents detected broken deposit and treasury-balance invariants within roughly 40 minutes and committed to reimbursing users.
- 3Tracing stolen funds forces difficult choices about enforcement, censorship resistance, and privacy-focused assets such as Monero and Zcash.
Don't miss
The team used the suspected attacker’s public key to send an encrypted invitation to a Signal group, opening a channel for negotiation.
The brief
Alex Shevchenko explains how a bridging bug let an attacker spoof USDT deposits through faulty asynchronous coordination, creating approximately $3.8 million in losses.
NEAR Intents detected broken protocol invariants in roughly 40 minutes by comparing recorded deposits with treasury balances, then accepted responsibility for reimbursing users.
The investigation combined public blockchain data, web information, and internal logs; the team linked exploitation accounts to a suspected person or group without claiming a court determination.
The team used the suspected attacker’s public key to send an encrypted invitation to a Signal group, turning a technical investigation into an uncertain negotiation.
The recovery effort raises a broader question: how can a cross-chain protocol block funds identified as stolen while respecting decentralization, censorship resistance, and privacy assets such as Monero and Zcash?
What was said on this episode
33 statements · 16 positive · 14 negative · 3 neutral
Audits failed to detect the exploit sequence.
“This was audited multiple times. Unfortunately, our auditing companies were not able to discover this mode of operations and this sequence of the actions that was leading to the exploitation of this bug.”
Listen at 2:24
Near Intents leads cross-chain swapping with approximately 50% volume share.
“at the moment, we are the leader of the cross-chain market swapping. And we are serving approximately 50% of the swapping volume.”
Listen at 4:20
The exploit created false deposit records without actual asset deposits.
“Infrastructure was tricked, believing that he did deposit the assets. So it created the record on the near side in the smart contracts that this user has these assets. While in fact, these assets were not deposited.”
Listen at 5:30
Near Intents reacted to the exploit in approximately 40 minutes.
“The reaction time was around 40 minutes on this stuff.”
Listen at 7:38
Near Intents processes approximately $200 million daily at one-to-three transactions per second.
“Through Near Intense, we usually have approximately $200 million going through approximately one to three transactions per second every single day.”
Listen at 7:44
Near Intents accepted responsibility because the protocol contained a bug.
“we definitely saw that there is a bug in the protocol, which means that this is our fault.”
Listen at 9:07
Near Intents had sufficient funds to cover the exploit loss.
“we do have money to cover this loss.”
Listen at 9:19
The investigation linked exploitation accounts to a person or closely associated group.
“We were able to find the very hard and very convincing evidences that are linking the exploitation accounts with a particular person or potentially with a group of people that are extremely close to this person.”
Listen at 12:58
A previous exploit’s stolen funds were fully returned after similar investigative actions.
“all of the money were returned back the same way how here.”
Listen at 15:25
The investigation prioritized recovering funds over proving the operator’s identity.
“it is not needed. That is not the goal. The goal is to return the funds.”
Listen at 16:57
Near Intents replenished affected smart-contract funds from its own resources.
“from our own pockets, we were able to replenish the funds inside of the smart contracts already.”
Listen at 22:24
Hackers face a high probability of being traced when qualified counterparties investigate.
“there is extremely high chance that you're going to be traced.”
Listen at 24:13
Hackers may be tracked and imprisoned under less lenient recovery approaches.
“If people have a different philosophy of how to handle the situations rather than us, there is a high chance that you're going to be tracked up until the point in time that you're going to go to jail.”
Listen at 24:20
Vulnerability researchers should use bug bounties instead of disrupting services.
“please please use backbounties do good stuff instead of disrupting the service.”
Listen at 25:58
AI-assisted hacks increased beginning in March.
“We have seen that there is an uptick of the AI-assisted hacks that started to happen in March this year.”
Listen at 28:19
Attackers began using AI systems to assist with hacks.
“Attackers started to use them to assist in these hacks.”
Listen at 28:31
Shield reduced Near Intents’ Litecoin incident losses by 80%.
“And it decreased our losses within that incident by 80%.”
Listen at 29:24
Near Intents Shield detects suspicious activity and blockchain operational deviations.
“this is kind of like our internal oracle, if you wish. That answers us the question, is there something sketchy happening here?”
Listen at 29:36
Shield detected over $50 million linked to the BitGet hack entering Near Intents.
“We detected more than 50 million US dollars who were trying to path through near intents that are connected with this hack.”
Listen at 30:13
Shield locked approximately $500,000 during transaction execution.
“Approximately 500,000 US dollars were locked amid execution with this system.”
Listen at 30:32
Only $166,000 linked to the BitGet hack passed through Near Intents.
“And through the near intents, it was only $166,000 which passed.”
Listen at 30:45
Shield kept approximately 99% of linked BitGet funds outside Near Intents.
“99% was kept outside of the protocol.”
Listen at 30:56
Near Intents is decentralized.
“The answer about whether NeuroIntense is decentralized or centralized, the answer is that it is decentralized.”
Listen at 33:42
No single party can stop Near Intents execution.
“There is no single party that is able to stop execution.”
Listen at 33:47
Shield blocks funds associated with clearly illicit activities and hacks.
“the SHIELD system at the moment is blocking things that are like 100% bad. You know, child pornography, finance and terrorism and stolen and hacked funds”
Listen at 35:21
Unbounded crypto systems would undermine crypto’s future value.
“if we're building these type of systems, Without boundaries, it means that we are building towards the future where crypto doesn't have any value.”
Listen at 37:05
Crypto systems should do everything possible to block illicit funds.
“there are black money and there are white money and we need to do everything that is possible in order to block black money”
Listen at 39:43
Metadata analysis can identify some links between hacked and legitimate shielded Zcash tokens.
“With Shielded Zcash, there are ways how to determine whether there is a connection in between the tokens that are connected with the hack and which are not.”
Listen at 40:36
Privacy protocols will attract illicit actors and face regulatory pressure at entry and exit points.
“my expectation that over time through these protocols, they're going to attract illicit actors and the regulators will not be in the position to kind of look inside of this. And they're going to try to choke these protocols on the boundaries, on the entrances and exits.”
Listen at 41:12
Monero trades on only a small number of exchanges, excluding major exchanges.
“Monero is tradable only on a handful of exchanges. No big exchanges trade in Monero.”
Listen at 41:32
Some BitGet-hacked funds remain shielded within Zcash.
“there was a portion that was hacked from BitGet straight on Zcash. And these funds are remaining there. And they're shielded.”
Listen at 42:55
Illicit activity volume through Monero is several times its market capitalization.
“the volume, is several times bigger than the market cap of Monero.”
Listen at 43:39
Zcash could face government pressure and exchange delistings if illicit use grows.
“there will be choking operations and the governments are going to go to centralized exchanges, say to delist it, all of the same things. are going to happen with Zcash, similar to Monero.”
Listen at 44:38
Statements are attributed to the speaker as said on the episode and reflect their view at the time, not PodLume's. They are not advice.