The NEAR Intents hacker returned the stolen $3.8 million on October 1, 2026, Alex Shevchenko, general director of the crypto exchange protocol, announced on October 2 on Tremplin.io cross-referenced this announcement with Bitquery’s on-chain analysis: around a fifth of the loot had passed through NEAR Intents itself during the theft.
In brief
- Night of September 30 to October 1 (UTC): $3.87 million in USDT is withdrawn in five installments from a NEAR Intents vault on BNB Chain, according to Bitquery; NEAR Intents suggests approximately $3.8 million.
- October 2: the hacker returns the funds before the end of the 48-hour period (Alex Shevchenko, on X).
- As of October 1 at 2:30 p.m. UTC, 76% of the loot was in bitcoin (34.69 BTC) and 21% had reached KuCoin (Bitquery).
- The amount stolen is equivalent to approximately 1% of the $387.5 million stolen from Bitget on September 24 (Tremplin.io calculation, according to Bitget).
How did NEAR Intents collect $3.8M in less than 48 hours?
THE crypto hacker returned the funds on October 2, before the ultimatum expired, wrote Alex Shevchenko on X. The announcement comes a week after the Bitget hack, which NEAR Intents said blocked part of the fund transfers.
Funds from the $3.8M NEAR Intents hack have been returned in full. We are stopping the investigation.
Alex Shevchenko, Managing Director of NEAR Intents, on X, October 2, 2026
According to NEAR Intents on bug in the interaction between the deposit and withdrawal Omni layer and the main smart contract (the code that holds the funds) enabled the theft. The service suspended operations, promised full compensation and alerted authorities. Our first article on the NEAR Intents hack details these announcements.
The analysis of Bitquery specifies the process: 3,865,000 USDT withdrawn from a vault on BNB Chainin five withdrawals spread over approximately six hours, after two tests of 10 and 11 USDT.
However, this figure does not tell the whole story. The gap with the $3.8 million announced by NEAR Intents could come from the latest withdrawal of 35,000 USDT. Moreover, the detailed report promised on October 1 is not published at this stage.
Where did the funds go after the crypto hack?
As of October 1 at 2:30 p.m. UTC, 76% of the loot was converted into 34.69 BTC spread across four walletsand 21% ($802,000) had reached KuCoin deposit addresses, according to Bitquery. The investigator ZachXBT had also reported a passage through KuCoin, then a transfer to Bitcoin.
Another fact noted by Bitquery: approximately $822,000 was exchanged through NEAR Intents during the flight, automated exchanges that say nothing about what the protocol knew, or when.
Why did the crypto hacker return the funds?
The exact reason has not been publicly established. NEAR Intents claimed to have identified the attacker and gave him 48 hours to practice the responsible disclosurethat is to say reporting a crypto flaw rather than exploiting it, in a message on X.
You know better than most how responsible disclosure works: this is the last window to use it. After 48 hours, this window closes.
Alex Shevchenko, Managing Director of NEAR Intents, on X, October 2, 2026
A message attached to a transaction, shared by Alex Shevchenko and which appears to come from the attacker, acknowledges his wrongs and invites the use of bug bounty programs (bonuses for reporting flaws). L’crypto hacker identity and the method of identification have also not been made public.
Is the NEAR Intents hack linked to the Bitget hack?
At this stage, there is no public evidence to establish that the two crypto hacks are the work of the same actor. Bitget suspects a North Korean group for its September 24 attack, without independent confirmation.
NEAR Intents claims to have blocked more than $50 million in transfers attempted by crypto wallets linked to Bitget: $503,000 frozen in execution and $166,000 passed, according to Alex Shevchenko.
NEAR Intents hack: what we know and what we don’t yet know
| Element | Information |
| Withdrawals | Night of September 30 to October 1 (UTC), $3.87M in five withdrawals (Bitquery) |
| Ultimatum | 48 hour deadline announced by Alex Shevchenko |
| Restitution | October 2, before the deadline, announced by Alex Shevchenko |
| Identity of the attacker | Non-public, identification method not detailed |
| Reason for restitution | Not publicly established |
| Technical report | I promise, not published at the time of writing this article |
| Link with Bitget | No public information at this stage |
The rest is due to an as yet undated deadline: the detailed report promised by NEAR Intents. He will say whether this hack remains an isolated incident or whether it reveals a fragility of its cross-chain infrastructure, which covers 35 blockchains, after the crypto hacks in September.
Maximize your Tremplin.io experience with our ‘Read to Earn’ program! For every article you read, earn points and access exclusive rewards. Sign up now and start earning benefits.
