NEAR Intents recovers all $3.8 million lost to a bug in its deposit-and-withdrawal layer

NEAR Intents' product removes a choice from the user. A user states the outcome of a trade, independent market makers called solvers fill it, and the user never picks a bridge or an exchange ^[10]. The design has reportedly carried more than $30 billion of volume across 35 blockchains ^[7]. According to the protocol's posts on X, Thursday's bug sat in how its Omni deposit and withdrawal infrastructure interacted with its smart contract, and the fault has since been patched ^[1].

Against volume, the loss looks small. $3.8 million ^[2] over $30 billion is about 0.013%, roughly one dollar in every 7,900 that has passed through ^[16]. Or rather, it is small against cumulative volume, a denominator that grows every day the layer works and tells a user little about how far a single bug can reach.

The terms of the return are harder to read. "We have identified you, sir," general manager Alex Shevchenko wrote ^[5]. He later thanked the attacker "for your willingness to cooperate" and pointed to messages that could be decrypted with the private key of an Ethereum address ^[12]. After the money came back he wrote: "We are stopping the investigation. Please use bug bounties instead of disrupting the services." ^[6] A protocol that said it knew who the attacker was has now stopped looking ^[5][6]. The source does not report whether the attacker kept a bounty. The GMX exploiter returned about $37.5 million in July 2025 after accepting a 10% white-hat bounty ^[15]. Euler Finance recovered more than $177 million of a $197 million hack from March 2023, about 90% ^[14][18].

One reading is that the patch holds and 0.013% is the right size for the risk ^[16]. A second is that a full return in exchange for a dropped investigation becomes the template the next attacker expects ^[6]. A third is that co-founder Illia Polosukhin's account of damage confined to USDT on BNB Smart Chain ^[11] describes luck, and the next bug in the same layer reaches further.

I think the first reading is too generous. The protocol has shown it can police tainted money: before the hack it turned away more than $50 million tied to the September 24 Bitget breach and froze about $503,000 through its SHIELD risk system ^[9]. Shevchenko has said builders cannot run infrastructure designed to "help launder stolen funds" ^[13]. That record concerns other people's stolen money. Thursday's loss came through the protocol's own deposit-and-withdrawal code ^[1]. The attacker's refund paid for this incident, and whether the code is safe now rests on the patch alone.

This view is wrong if a NEAR Intents post-mortem shows the Omni layer caps what any one bug can withdraw, so that confinement to one token on one chain was the design working and not chance.