NEAR Intents General Manager Alex Shevchenko: Attacker Willing to Cooperate
NEAR Intents General Manager Alex Shevchenko stated that the exploiter has transferred 1 BNB to the recovery wallet and expressed willingness to cooperate in the transaction message, requesting a Signal contact.
This transfer came from the same address that previously withdrew approximately $3.8 million. About an hour earlier, the address also transferred 0.295 ETH on the Ethereum network with the same message. The original on-chain message stated a willingness to cooperate and requested a reply via Signal for contact.
Shevchenko had previously publicly stated that he had identified the party and provided a 48-hour window for return, ending around October 4 at 00:18 UTC. He published three return addresses corresponding to Bitcoin, a shared address for BNB chain and Ethereum, and Solana, stating that the other party understands responsible disclosure better than most, marking this as the final window.
The exploit occurred on October 1, with the team stating that the issue arose from the interaction between the Omni deposit and withdrawal infrastructure and the NEAR Intents smart contract. The losses were primarily in USDT, concentrated in related contracts on the BNB chain; on-chain records show that approximately 3.87 million USDT left the documented HOT Bridge treasury address within about six hours, starting with two test transfers of 10 USDT and 11 USDT, followed by five larger withdrawals ranging from about $35,000 to $1.5 million. The team stated that the contract side has been patched, 11 networks have paused deposits and withdrawals, and they have committed to fully compensating users.
On-chain tracking pointed the outflow of funds to KuCoin, which was then bridged to Bitcoin. NEAR Intents had a trading volume of about $4.7 billion in the last 30 days. The 1 BNB and 0.295 ETH transfers did not return the USDT that was taken but merely shifted negotiations from public posts to off-chain communication requests.
This is a privately driven contact based on the event, not a public market buy. The seller is the exploit address, while the buyer or recipient is the recovery wallet announced by the project; the main funds remain in the transferred stablecoins and the bridged Bitcoin, with 1 BNB and 0.295 ETH serving only as message carriers. If a return occurs, the beneficiaries will be the users awaiting compensation and NEAR Intents under repayment pressure; if only contact information is exchanged without a return, the pressure will still be on the treasury gap and the 11 networks that have paused deposits and withdrawals.
Source: Public Information
ABAB AI Insight
Alex Shevchenko is a co-founder of Aurora, an Ethereum-compatible network running on NEAR. Earlier this year, he publicly stated he had identified the attacker in another NEAR-related exploit; that incident saw asset returns, with Tether freezing approximately $3.29 million in related USDT. This time, he issued the ultimatum using a personal account rather than the project's official account, directly writing the responsible disclosure jargon to the other party.
The funds of NEAR Intents are not primarily on the NEAR main chain but rather on the cross-chain deposit and withdrawal layer. Approximately 3.87 million USDT was withdrawn from the HOT Bridge treasury address on the BNB chain, with the tracking path going through KuCoin before bridging to Bitcoin. The project side's resource mobilization includes patching the contract, pausing deposits and withdrawals across 11 networks including BNB chain, Polygon, TON, Optimism, and Avalanche, and committing to full compensation using their own or cooperative funds, rather than waiting for the attacker to return the funds first.
This is similar to the paths taken by Euler Finance and Wormhole after being exploited, where public negotiations occurred first, followed by partial or full returns: the attacker uses small transfers to write on-chain messages, exchanging for off-chain channels, while the project applies pressure through deadlines and law enforcement tracking. NEAR Intents is currently in a control phase, not an expansion: the $4.7 billion monthly trading volume indicates that the settlement layer has volume, with the gap stemming from the Omni deposit layer, not from the intent matching itself.
Structurally, this represents a reconstruction of the industry chain. Cross-chain intent separates user orders and multi-chain treasuries, shifting pricing power and failure points from single-chain contracts to deposit and withdrawal infrastructure. The treasury is on the BNB chain, messages are on Ethereum and BNB chain, and return addresses cover Bitcoin and Solana, indicating that the repayment capability of a redemption product depends on the weakest bridging interaction, rather than the transaction fees on the NEAR main chain.
ABAB News · Cognitive Laws
- Small transfers are negotiations; large transfers are returns.
- The convenience of cross-chain stops at the weakest layer.
- The project commits to compensation; the attacker is the one returning the funds.