NEAR Intents Says Exploit Refund Came Back in Bitcoin and Monero

NEAR Intents' general manager now says the money that came back after the $3.8 million exploit did not all arrive in Bitcoin. Part of it came back in Monero, and the team is still working out how to convert it.

For anyone waiting on a refund, that split is what changes: the Bitcoin leg is on chain, counted and done. The Monero leg is value the protocol says it holds but cannot pass on yet. NEAR Intents has already refilled its smart contracts from its own funds, so the only step left is getting the recovered money back to the people it came from.

Alex Shevchenko, the general manager of NEAR Intents, described the return in an episode of Unchained recorded on Oct. 8.

Kuncoro Counted 34.59 BTC on the Published Address

Independent onchain analyst Kuncoro checked the return addresses NEAR Intents published. The Bitcoin one received 34.59 BTC, about 78% of the total, between 14:31 and 15:05 UTC. The BNB/ETH address held 1.04 BNB and 0.30 ETH. The Solana address was empty.

From those figures, Kuncoro estimated roughly $850,000 had come back through another route. Shevchenko agreed. When Kuncoro wrote that the rest "came back through a different" route, Shevchenko replied, "You are right. It did indeed."

The Monero Leg Is Still In Process

After the Oct. 1 exploit, Shevchenko's team tracked the stolen assets and believed the non-Bitcoin portion was still sitting on Ethereum, BNB Chain and Solana. It was not. Shevchenko said everything was correctly identified on the Bitcoin blockchain, but the other assets had moved through hard-to-trace channels. In fact, he said, they had been traded into Monero.

Asked whether NEAR Intents still held the XMR, he said "this part is in process." That means converting the Monero into USDT, and he said companies have raised questions. "They're asking for the source of funds, and what are we gonna say the source of funds?" he said on the show.

How much of the refund arrived in Monero, he did not say.

What Shevchenko Said on Oct. 2

The account is a revision of the team's earlier public position. On Oct. 2, Shevchenko posted that the funds "were sent back in full" and that the team was ending its investigation. The published BTC wallet received about 34.59 BTC, and the protocol had already pledged to compensate the lost funds in full.

Before that, Shevchenko had set an Oct. 4 deadline for the alleged exploiter and published three return addresses across Bitcoin, BNB/ETH and Solana.

A BNB Chain transaction from an address labeled Near Intents Exploiter 1 carried a message saying all funds were returned and that the sender was in the wrong.

We've returned all the funds, we were in the wrong. Thank you to the Near team for being respectful, constructive, and cordial during the return process. Remember to always use bug bounties!

The attacker made contact in part to ask for the Monero address on which to return the funds, Shevchenko said. The private line came from a Signal group invite inside an encrypted message that only the attacker could decrypt, because it was encrypted with the attacker's own public key. "This encrypted message was encrypted with the public key of the attacker," he said, leaving the attacker as "the only person who is able to decrypt it."

What Is Still Open

The conversion of the Monero is not confirmed done. Whether the rest of the funds routed through Monero are attributable to the same attacker beyond Shevchenko's account has not been independently confirmed by an onchain analysis.

The bug itself sat in how NEAR Intents' Omni deposit and withdrawal layer interacted with its main smart contract. The team halted services on Oct. 1 after detecting it and reported the incident to law enforcement. The initial response affected deposits and withdrawals across 11 networks. The flaw was on the contract side and was patched shortly after detection.

Since the exploit, NEAR Intents has received several bug bounty submissions. One was valid and will be paid, Shevchenko said.