NEAR agreement successfully recovered all $3.8 million in stolen assets through intent mechanism

NEAR Intentions: All US$3.8 million stolen from this week's security breach has been recovered

NEAR Intentions announced that all US$3.8 million stolen from this week's security breach has been returned, marking the end of the asset recovery phase of the incident. The development came about a day after the parties to the agreement had previously confirmed that they had targeted the suspected attacker and given him a 48-hour repayment period.

General Manager Alex Shevchenko confirmed the asset recovery operation on October 2, saying that the stolen assets had been "fully returned" and NEAR Intentions would stop the investigation. The return of funds occurred before the deadline of the "responsible disclosure window" set by the parties to the agreement. The rapid recovery move changed the financial impact of the incident, which initially forced NEAR Intentions to suspend service and promise compensation to affected users.

How was the $3.8 million recovered?

According to analysis, the recovered assets are not completed through a single transaction, but are remitted through multiple paths. Public data on the address provided by Shevchenko shows that on October 2, approximately 34.59 bitcoins were transferred to the designated bitcoin recycling address, with a value of nearly US$3 million based on the price at the time of transfer. Smaller inflows of funds can also be seen in other public addresses, but the complete routing details of the rest have not been publicly disassembled by NEAR Intention. Despite this, Shevchenko confirmed that the total amount recovered had met expectations.

This result follows a series of unusual operations. Blockchain investigator ZachXBT has traced stolen assets flowing from the affected infrastructure to KuCoin and were subsequently bridged to the Bitcoin network. Preliminary investigation revealed that these abnormal withdrawals involved facilities on BNB Chain related to the HOT Bridge vault, rather than evidence of infringement of the NEAR underlying blockchain itself. The return of funds solves the direct asset gap, but it does not clarify the ownership of control of each wallet in the transaction chain, nor does it separately explain the specific operating mechanism of the underlying vulnerability.

Investor revelation

Full recovery substantially reduces the direct financial losses caused by the incident, but this should not be regarded as the same as resolving the security failure. The more critical disclosure at present is the technical explanation of why unauthorized withdrawals occurred.

What is the cause of the NEAR Intention vulnerability?

NEAR Intentions pointed out that the incident stems from flaws in the interaction between its Omni deposit-and-deposit infrastructure and NEAR Intentions smart contracts. The parties suspended services after detecting the problem and initially estimated the damage at approximately $3.8 million. Subsequently, the vulnerability on the contract side was repaired, and storage and retrieval capabilities across multiple networks were temporarily affected while the team worked to repair the broader Omni infrastructure. No detailed technical incident review report has been released to clarify exactly which verification or authorization mechanism allowed the attacker to remove funds. This detail is critical to determining whether the vulnerability is limited to a single withdrawal path or exposes reusable weaknesses that connect NEAR intentions to cross-chain infrastructure systems.

Significantly, this occurred shortly after NEAR Intentions announced that its SHIELD security system had helped prevent a transfer attempt in another major cryptocurrency theft involving more than $50 million. Previous reports showed that NEAR Intentions rejected the attempted transfers and froze approximately $503,000.

Investor Inspiration

This comparison suggests that transaction screening and infrastructure security are at different levels of control. A protocol can successfully detect suspicious funds flowing in the system, while its components responsible for depositing or clearing remain vulnerable.

Why is full recovery important?

When cryptographic protocols encounter vulnerabilities, they often offer attackers bounties, legal safe havens or limited repayment options. Once assets pass through centralized exchanges and cross-chain transmission, it is rare to achieve full recovery. NEAR Intention results were better than those in cases where only part of the stolen value was recovered. There have been recent reports that Symbiosis recovered 15 bitcoins in its native bridging vulnerability, but uncertainty remains about the relationship between the recovered assets and the actual profits of the attackers. Because NEAR Intentions has promised full compensation to affected users, asset recovery has also reduced the amount that the agreement or its supporters would have required direct capital injection.

Investor Revelation

With the return of US$3.8 million, the focus has shifted from solvency and reimbursement to operational risk. Comprehensive recovery confirmation of affected services, independent review of patches, and detailed incident review will provide better evidence to determine whether underlying risks are under control.

Questions that still need to be explained

Although NEAR Intention has concluded its investigation into financial recovery, a number of technical questions have not yet been publicly answered. These questions include: What are the precise flaws in authorized withdrawals? Can existing surveillance detect vulnerabilities earlier? Which infrastructure components need remediation? Have additional safeguards been introduced? In addition, the parties to the agreement did not publicly disclose the identities of individuals they said had been targeted, or did not elaborate on the investigation methods used to trace them.

For users and counterparties, the return of funds partly ends the most urgent part of the incident. Forthcoming's technical disclosure will determine whether the incident is an isolated software defect or evidence of a broader weakness in the cross-chain architecture that supports NEAR Intention.