Mentioned in This Article
1. NEAR Intents exploit funds came back partly in Monero
Alex Shevchenko, general manager of NEAR Intents, said in an episode recorded on October 8 that the attacker who drained about $3.8 million from the cross-chain protocol in the October 1 NEAR Intents exploit returned only part of the money in Bitcoin, and that the remainder came back as Monero (XMR). The team refilled its smart contracts from its own funds and is still working out how to convert the XMR.
The disclosure adds nuance to an episode that the project had described as resolved. On October 2, Shevchenko wrote on X that the funds had been returned in full and that the team was closing its investigation. His later comments show that the practical work of making users whole did not end with that announcement.
The exploit stands out less for its size than for how it ended. Attackers who take money from a protocol rarely hand it back, and when they do the return is usually in the same assets, on the same chains. In this case the route the money took after the theft has created a separate problem for the team that was robbed.
Cross-chain protocols such as NEAR Intents are attractive targets because they coordinate balances across several networks at once. A flaw in the logic that matches requests, or in the contracts that hold assets, can expose funds on more than one chain, which is why teams monitor multiple ledgers when they attempt to follow stolen money.
2. How the stolen assets were traced
After the exploit, the NEAR Intents team traced the stolen assets across blockchains. Shevchenko said the team initially believed the non-Bitcoin portion was still sitting on Ethereum, BNB Chain and Solana, the networks where the protocol operates. That belief turned out to be wrong.
The Bitcoin holdings, he said, had been identified correctly. The other assets had moved through channels that are hard to follow and had been traded into XMR, the privacy-focused token known for obscuring senders, recipients and amounts. Once value passes into Monero, the on-chain trail that investigators normally rely on largely disappears.
Tracing matters in an incident like this because it determines what a victim can do next. A team that can see where funds sit can approach exchanges, request freezes or negotiate. When the funds are converted into an asset designed to resist analysis, those options narrow, and the attacker's cooperation becomes the main route to recovery.
Monero differs from Bitcoin in design. Bitcoin transactions are public, so analysts can follow coins from address to address indefinitely. Monero uses ring signatures and stealth addresses to hide who sent a payment and who received it. That is why exchanges in many jurisdictions treat it with caution, and why it features prominently in discussions of laundering after hacks.
A return in two assets also raises a practical question for a victim: whether the attacker could have simply kept everything. Shevchenko did not offer a motive beyond the attacker's need for a destination address for the Monero.
The attacker sent a mix of Bitcoin and Monero because the money had already been moved into those assets, and Shevchenko said one reason the attacker contacted the team was to find out which Monero address the funds should go to. That detail reframes the return: the attacker needed something from NEAR Intents to complete it.
An independent on-chain analyst, Kuncoro, reviewed the return addresses the project published, and did so on the day of the announcement. The Bitcoin address had received 34.59 BTC, which Kuncoro calculated to be about 78% of the total. He concluded that the rest of the value must have come back by a different route, and Shevchenko agreed with that reading.
The published material did not state how much arrived in XMR. Shevchenko declined to give a figure for the Monero share. Asked whether NEAR Intents still held the XMR, he said the matter was "in process," which indicates that the conversion had not been completed at the time of the interview.
Stablecoins such as USDT are the usual currency for compensating users in decentralized finance, because they hold a steady dollar value. Converting a volatile or privacy-focused asset into one means selling it on a market with enough liquidity, and a large sale of Monero can move its price if it is not carefully paced.
Until the conversion is finished, the team carries the exchange-rate risk on the XMR it received, since the value in dollars can change between the time the funds arrive and the time they are sold. By restoring the contracts from its own money first, NEAR Intents took that risk on itself instead of leaving users exposed to it.
3. What happens to affected users?
The team has already refilled its smart contracts from its own resources, which means the protocol's balances were restored without waiting for the Monero to be sold. That step addresses the immediate hole created by the exploit and keeps the system functioning.
What remains is returning money to affected users. According to Shevchenko, that requires converting the XMR into USDT, a dollar-pegged stablecoin, so that it can be paid out. The conversion is where the difficulty lies.
Companies that handle the conversion have raised questions about where the funds came from, Shevchenko said, and he described that scrutiny as a challenge. Trading firms and exchanges that accept large amounts of a privacy coin after a hack typically want assurance that they are not receiving proceeds of crime. The cooperative return of the money helps the team make its case, but the questions still slow the process.
Shevchenko also said that handling Monero was a new experience for him, and that his first time doing so came during the hack. Few teams in decentralized finance deal with the asset regularly, since most protocols are built around Ethereum-compatible tokens, Bitcoin and mainstream stablecoins.
4. An invitation only the attacker could open
The channel through which the two sides communicated was itself unusual. The attacker sent an on-chain message offering to cooperate and asking for a Signal contact, so that the discussion could move to a private messaging app.
Shevchenko replied with an encrypted message containing an invitation to a Signal group. Because the message was encrypted with the attacker's public key, only the attacker could read it. The approach let the team extend an offer to talk without exposing the contact details to anyone watching the chain.
On-chain messaging has become a common way to open negotiations after exploits, because transactions are public and permanent, and both parties can be sure the message came from the controlling address. Encrypting the reply to the attacker's key added privacy to a conversation that would otherwise have played out in view of the entire market.
The bounty argument is also about timing. A researcher who finds a flaw has a choice between disclosing it for a fee and exploiting it for a much larger sum. Programs that pay promptly and clearly, and that promise not to pursue good-faith reporters, make the first option more attractive.
5. The case for bug bounties
Shevchenko again urged hackers to use bug bounty programs rather than exploit protocols. A bounty rewards a researcher for reporting a vulnerability privately, and avoids the losses, disruption and legal risk that follow a real attack.
He said NEAR Intents has received several submissions since the exploit, and that one of them was valid and will be paid. The figure shows that the incident has drawn attention from researchers who prefer to be paid for findings, and it gives the team a concrete example to point to when making the argument.
For the broader industry, the incident is a reminder of the economics behind these programs. A protocol that holds millions of dollars in user funds can often pay a researcher far less than the amount at stake in an exploit, and the existence of a reward gives skilled people a legitimate alternative.
For users of the protocol, the most important question is simply when they will be fully repaid. For others in decentralized finance, the case is a study in what happens after a negotiated return: the legal and operational friction of receiving a privacy coin can be a significant cost of its own.
6. What comes next for NEAR Intents
The main open item is the conversion of the Monero into USDT and the payment to affected users. Shevchenko did not give a date, and the pace will depend on how quickly counterparties are satisfied about the origin of the funds.
The team will also have to decide how it responds to the valid bug bounty submission, which Shevchenko said will be paid. Users and observers will be watching for confirmation that every affected account has been compensated, and for any further published detail on how the October 1 exploit worked.
The episode shows that a return of stolen funds does not automatically close an incident. When the money comes back in a form that is difficult to use, the victim must still find a way to turn it into something it can pay out, and that stage can take longer than the negotiation that preceded it.
Readers following the case should watch for an update from the team on the size of the Monero share, the completion of the conversion and the timing of repayments, none of which had been disclosed when the interview was recorded.