NEAR Intents Says Exploited $3.8 Million Returned, Hack Probe Closed

The speed of recovery here is the story: funds came back within a day of a public identification post, which suggests the attacker was either identifiable or negotiable rather than insulated. That matters less as a security fix than as a precedent for how these incidents get resolved, since it rewards public attribution over quiet negotiation or law enforcement. The open question is whether this reflects better tracing capabilities or simply an attacker who preferred returning funds to being pursued.