The NEAR Intents exploit moved from containment to recovery Friday night after the protocol received the entire amount taken during this week’s breach.
NEAR Intents General Manager Alex Shevchenko said the roughly $3.8 million had been returned in full, ending an investigation that began after the cross-chain infrastructure detected unauthorized withdrawals.
The published Bitcoin recovery wallet received approximately 34.59 BTC, providing onchain confirmation that a substantial portion of the returned value reached the recovery address. The Defiant
This materially changes the story Token Recon was tracking after the initial exploit.
The October 1 breach involved a bug in the interaction between Omni deposit and withdrawal infrastructure and the NEAR Intents smart-contract system. Services were paused while the vulnerability was investigated.
NEAR Intents had already pledged to compensate affected users.
The situation escalated Friday when the team said it had identified the person responsible and gave the exploiter 48 hours to return the assets through what it described as responsible disclosure.
The money came back before the dispute developed further. Cointelegraph
Blockchain investigator ZachXBT had previously reported that stolen funds moved through KuCoin and were bridged toward Bitcoin. That movement should not be confused with proof of liquidation. It describes the traced route through which the assets moved before the recovery. Cointelegraph
TOKEN RECON ASSESSMENT
This is a genuine material update rather than a continuation of the exploit story.
The financial loss has effectively been reversed, but the security lesson remains.
NEAR Intents demonstrated that identifying an attacker can materially change recovery leverage. The result is substantially better than the normal exploit trajectory in which assets disappear through bridges, exchanges, mixers or privacy infrastructure.
Full fund recovery does not prove the affected infrastructure is ready for unrestricted operation. The remaining technical confirmation is whether the patched architecture eliminates the vulnerability that allowed the unauthorized withdrawals in the first place.
Recovery closes the financial phase. Technical remediation closes the security phase.
Sources
The Defiant, NEAR Intents says $3.8 million was returned in full
