NEAR Intents Exploit: Attacker Identified, 48-Hour Deadline Set for $3.8M Return
TREE NEWS reports: A security incident targeting NEAR Intents has entered a new phase after Aurora co-founder Alex Shevchenko publicly stated that the team has identified the individual behind the exploit. The attacker now has 48 hours to return approximately $3.8 million in misappropriated funds. The disclosure marks a notable shift from the typical cat-and-mouse dynamic that follows DeFi exploits, where anonymity often shields perpetrators indefinitely.
What Happened
NEAR Intents is a cross-chain execution layer built on the NEAR Protocol that allows users to express desired outcomes — such as swaps or transfers across chains — which are then fulfilled by competing solvers. The architecture has gained traction as a UX-focused alternative to traditional bridging, but it also concentrates risk in the intent-settlement and solver infrastructure. The exploit drained roughly $3.8 million, and the team’s rapid attribution suggests on-chain forensics and off-chain intelligence have narrowed the suspect pool considerably.
Why Attribution Matters
Publicly naming or identifying an attacker is rare and consequential. In past incidents, projects have relied on chain-analysis firms like Chainalysis and TRM Labs, law enforcement referrals, and negotiation via on-chain messages. When a team claims it knows who the attacker is, it typically signals one or more of the following:
- KYC-linked infrastructure: The attacker may have interacted with a centralized exchange or service that collected identity data.
- Operational security failures: Reused wallets, IP leaks, or social-media trails may have exposed the individual.
- Insider involvement: Some exploits trace back to parties with privileged access or familiarity with internal systems.
Each scenario carries different legal and recovery implications. An insider case could involve employment contracts, criminal referrals, and civil litigation, while an external attacker may face sanctions and exchange-level asset freezes.
Implications for the Intent-Based Ecosystem
The incident arrives as intent-centric architectures — NEAR Intents, UniswapX, CoW Protocol, and various solver networks — compete to become the default execution layer for cross-chain activity. Security is the central battleground. A high-profile exploit can erode user confidence faster than any fee advantage can rebuild it, and the 48-hour ultimatum is as much a reputational play as a recovery tactic.
If the funds are returned, NEAR Intents can frame the episode as a contained incident with a decisive response. If not, the team will likely escalate to law enforcement, publish on-chain evidence, and coordinate with exchanges to blacklist addresses. Either path sets a precedent for how intent protocols handle adversaries.
Forward Look
The next 48 hours will be closely watched across DeFi. A successful recovery would reinforce the value of rapid attribution and negotiation; a failure would intensify calls for stronger solver-level guarantees, insurance mechanisms, and possibly protocol-owned security funds. For users, the episode is a reminder that cross-chain convenience still carries smart-contract and operational risk — and that the maturity of the intent sector will be measured by how it responds when things go wrong.
