Current outcome
The stolen NEAR Intents funds have been fully recovered; the team says it identified and contacted the responsible party within 24 hours of the attack and credited the AI security layer SHIELD. NEAR says it will continue strengthening its security systems, and the incident has moved into post-recovery wrap-up.
Progress timeline
7 material updates- #01
Community Alert: Near Intents was exploited for $3.8M+ after its BSC hot wallet
Near Intents suffered a hot-wallet exploit on BSC with over $3.8M in irregular outflows, prompting it to halt transactions amid a multi-EVM-chain incident, with the stolen funds routed to KuCoin and bridged to Bitcoin.
Source evidence: investigations · theblockbeats · The Defiant · Decrypt · Cointelegraph · Protos
- #02
NEAR Intents确认遭攻击，涉案金额超380万美元
NEAR Intents formally confirmed the exploit, attributing it to flaws in its Omni deposit/withdrawal infrastructure and contract interactions; it has patched the contract, expects core services back within ~1 hour, pledged full reimbursement of affected assets, paused BSC/Polygon/TON deposits and withdrawals for an additional ~12 hours, and filed a report while pursuing on-chain tracing.
State after update: Near Intents has confirmed an exploit exceeding $3.8M caused by flaws in its Omni deposit/withdrawal infrastructure and contract interactions; the contract flaw is patched, core services are expected to resume within ~1 hour, BSC/Polygon/TON deposits and withdrawals remain paused for an additional ~12 hours, full reimbursement is pledged, a report has been filed, and stolen funds were routed to KuCoin and bridged to Bitcoin.
Source evidence: theblockbeats · foresightnews · wublockchainenglish · The Block
- #03
NEAR Intents hit by $3.8 million exploit as crypto's rough year of hacks continues
New report discloses expanded affected network scope: in addition to BSC, Polygon, and TON, deposit/withdrawal disruptions also affect Optimism, Avalanche, Stellar, Monad, X Layer, ADI, Scroll, and Plasma; details that the platform has processed over $30B across 35 chains are also mentioned.
State after update: Near Intents has confirmed an exploit exceeding $3.8M caused by flaws in its Omni deposit/withdrawal infrastructure and contract interactions; the contract flaw is patched, core services are expected to resume within ~1 hour, but deposit/withdrawal disruptions now affect multiple networks including BSC, Polygon, TON, Optimism, Avalanche, Stellar, Monad, X Layer, ADI, Scroll, and Plasma, with pauses potentially prolonged; full reimbursement is pledged, a report has been filed, stolen funds were routed to KuCoin and bridged to Bitcoin, and law enforcement and security firms are tracing.
Source evidence: CoinDesk
- #04
⚡️NEAR Intents攻击者或为Lazarus Group
The attacker's address interacted with a wallet flagged as North Korea's Lazarus Group (0x098B7...E2f96), suggesting the attacker may be Lazarus Group.
State after update: Investigation into the NEAR Intents exploit continues; the attacker's address has been linked to a wallet flagged as North Korea's Lazarus Group, suggesting the attacker may be Lazarus Group. Previously confirmed: over $3.8M loss, deposits/withdrawals suspended across 11 networks, and full compensation pledged.
Source evidence: theblockbeats
- #05
NEAR Intents says its identified the hacker, gives 48-hour ultimatum
NEAR Intents general manager Alex Shevchenko said the attacker has been identified and publicly shared three wallet addresses (BTC, BNB, SOL), issuing a 48-hour ultimatum for the funds to be returned under responsible disclosure before the window closes.
State after update: In the NEAR Intents exploit, the protocol says it has identified the attacker and issued a 48-hour ultimatum to return funds; previously confirmed: over $3.8M loss from a flaw in Omni deposit/withdrawal and smart contract interaction, services paused, full compensation pledged, and the attacker's address linked to a wallet flagged as North Korea's Lazarus Group.
Source evidence: Cointelegraph · theblockbeats · foresightnews
- #06
【NEAR Intents 黑客链上转账留言称愿意合作，项目方此前要求其 48 小时内归还资金】
The NEAR Intents exploiter transferred 1 BNB and 0.295 ETH to the recovery wallet with messages offering cooperation and requesting a Signal contact; the project replied thanking them for cooperating.
State after update: In the NEAR Intents exploit, the attacker has sent on-chain messages offering cooperation and requesting a Signal contact, and the project has acknowledged and thanked them; previously the project identified the attacker and issued a 48-hour ultimatum to return funds; full funds have not yet been returned and the situation is ongoing.
Source evidence: foresightnews
- #07
NEAR联创谈追回被盗资金：Intents上AI安全层SHIELD锁定黑客
NEAR co-founder Illia Polosukhin said the stolen NEAR Intents funds were fully recovered after the responsible party was identified and contacted within 24 hours, with full recovery completed at 14:30 UTC; he credited the AI security layer SHIELD on Intents and investigative work.
State after update: The stolen NEAR Intents funds have been fully recovered; the team says it identified and contacted the responsible party within 24 hours of the attack and credited the AI security layer SHIELD. NEAR says it will continue strengthening its security systems, and the incident has moved into post-recovery wrap-up.
Source evidence: theblockbeats