NEAR 意图漏洞事件：黑客在48小时最后通牒后归还380万美元

NEAR Intentions hackers return stolen funds: US$4.8 million returned before deadline

On October 2, 2026, Alex Shevchenko, CEO of the crypto exchange protocol NEAR Intentions, announced on the X platform that the US$3.8 million previously stolen on October 1 had been fully recovered. The return of the funds was completed before the expiration of a 48-hour ultimatum for the attacker, who the leader claimed to have identified.

Cotribune cross-verified this statement through Bitquery's on-chain analysis: Data showed that during the theft, about one-fifth of the stolen money flowed through the NEAR Intention itself.

Event Summary

• September 30 to October 1 night (UTC): According to Bitquery data, the NEAR Intentions vault on BNB Chain made five withdrawals totaling USDT in about six hours; the amount mentioned by NEAR Intentions is approximately US$3.8 million.
• October 2: Hackers returned funds before the 48-hour deadline ended (according to Alex Shevchenko posted on X).
• Where the funds go: As of 2:30 pm (UTC) on October 1, 76% of the stolen money was held in Bitcoin (34.69 BTC), and 21% had flowed into KuCoin (according to Bitquery data).
• Size comparison: The stolen amount accounted for approximately 1% of the US$387.5 million stolen from Bitget on September 24 (according to Cotribune calculations based on Bitget data).

How did NEAR intentions recover $3.8 million in less than 48 hours?

Alex Shevchenko wrote on X that the cryptocurrency hacker refunded the funds on October 2, before the ultimatum expired. The announcement came a week later after NEAR Intention said it had blocked some of the transfer of funds from the Bitget hack.

"All US$3.8 million in NEAR Intentions 'hacked funds has been returned. We stop investigating."

According to NEAR Intentions disclosed on X, the technical flaw that led to the theft lies in the interaction flaw between the deposit and withdrawal Omni layer and the main smart contract (i.e., the code that holds funds). The service has suspended operations, promised full compensation, and an alert has been issued to authorities. Our first article on the NEAR Intentions hack documented these announcements in detail.

Bitquery's analysis revealed the specific process: After two test withdrawals (10 USDT and 11 USDT respectively), the vault on the BNB Chain made five withdrawals totaling 3,865,000 USDT in about six hours.

However, this number does not reflect the whole picture. The difference between the US$3.8 million reported by NEAR Intentions and the Bitquery data may stem from the last withdrawal of US$35,000. In addition, a detailed report originally scheduled to be released on October 1 has not yet been released at this time.

The flow of funds after cryptographic hacking

According to Bitquery, as of 2:30 pm (UTC) on October 1, 76% of the stolen money had been converted to 34.69 BTC, distributed among four wallets; another 21%(US$802,000) had reached KuCoin's recharge address. Investigator ZachXBT also reported on how funds passed through KuCoin and then transferred to Bitcoin.

Another fact pointed out by Bitquery is that during the theft, approximately $822,000 was redeemed through NEAR Intention. These automated redemption operations do not reveal what the parties know, nor do they show when they occur.

Why do cryptocurrency hackers refund funds?

The exact cause has not been publicly established. NEAR Intentions claimed to have identified the attacker and posted a message on X giving him 48 hours for "responsible disclosure," which means reporting the encryption vulnerability rather than exploiting it.

"You understand better than most how responsible disclosure works: This is the last window into using it. In 48 hours, this window will close."

Alex Shevchenko (seemingly from an attacker) admitted wrongdoing and recommended using the vulnerability bounty program (rewards for reporting vulnerabilities). Similarly, the identity and identification method of cryptographic hackers have not been disclosed.

Is the NEAR Intention hack related to the Bitget incident?

目前阶段，没有公开证据表明这两起加密黑客攻击是由同一主体实施的。Bitget 怀疑其9月24日的攻击由朝鲜集团所为，但缺乏独立证实。

NEAR Intents 表示，它阻止了与 Bitget 相关的加密钱包尝试转移的超过5000万美元资金：其中503,000美元在执行中被冻结，166,000美元成功通过（据 Alex Shevchenko 所述）。

NEAR Intents 黑客攻击：已知与未知事项

来源：NEAR Intents、Alex Shevchenko、Bitquery。信息截至2026年10月5日。

后续发展取决于一个尚未确定的截止日期：NEAR Intents 承诺发布的详细报告。该报告将揭示此次黑客攻击是孤立事件，还是暴露了其跨链基础设施（涵盖35条区块链）中的弱点，尤其是在经历了9月份的加密黑客攻击之后。