How NEAR Intents Identified a Suspect and Got Its Stolen…

PodcastUnchainedAlex ShevchenkoOct 9

The guest describes how a bug in NEAR Intents led to a $3.8 million loss, how monitoring helped the team detect it, and how investigators used public information and internal logs while pursuing fund recovery. The discussion also examines privacy protocols, cross-chain security, and the role of compliance and DAO governance in handling funds. The guest argues that protecting ownership and assigning responsibility are important to crypto's long-term value.

Blockchain Crypto Regulation DeFi

Preview · 18 more points in the app

Read the Full Summary

Key Takeaways

The $3.8 million NEAR Intents exploit arose from interactions across an asynchronous, multichain setup: transactions targeting USDT on BNB Chain led the infrastructure to record assets on NEAR without a deposit. The guest said multiple audits missed the path because it required a particular mode and sequence of actions, rather than reflecting a flaw in one isolated smart contract.

Monitoring helped NEAR Intents detect a mismatch between its recorded deposits and Treasury holdings in about 40 minutes, prompting the Security Council to pause contracts. The guest also cited Shield’s monitoring as reducing losses by 80% in a Litecoin incident, while about 99% of funds connected with the Bitget hack were kept outside NEAR Intents and about 1% was frozen.

The guest described returning or protecting users’ funds—not punishing a suspected attacker—as the priority: NEAR Intents replenished its contracts and said it would cover users’ losses from its own funds. In the current incident, the funds’ conversion into XMR made their path difficult to trace and conversion to dollars challenging; in the earlier Ria Protocol attack, approximately $20 million was returned after the team gathered logs and contacted a person linked to the incident, without establishing that person’s guilt.

GEO-POLITICS

Privacy Protocol Rules — The guest expects regulators may restrict privacy protocols at their entry and exit points if illicit activity grows and transactions remain difficult to inspect. He notes that Monero trades on only a handful of exchanges, with no major exchanges listing it. He says governments could push centralized exchanges to delist Zcash if illicit activity becomes widespread.

“That's why I do believe that what the regulators are going to do about these protocols, my expectation that over time through these protocols, they're going to attract illicit actors…”—

TECHNOLOGY

NEAR Exploit — NEAR Intents halted services after an exploited bug caused a $3.8 million loss. The guest says multiple audits missed the exploit path because it depended on a particular mode and sequence of actions.

“So last Thursday, Near Intense had to halt services after someone exploited a bug causing the protocol to lose $3,800,000.”—

Cross-Chain Failure — The attacker targeted USDT on BNB Chain, using transactions that led the infrastructure to record assets on the NEAR side without a deposit. The guest describes a failure in how components interacted across a complex, asynchronous, multichain setup—not a spoofing attack or a flaw in one isolated smart contract.

“The attacker has been focusing on one particular chain, which was the BNB chain, and one particular asset there, which is USDT…”—

Exploit Detection — NEAR Intents typically handled about $200 million per day at roughly one to three transactions per second. Monitoring helped the team detect the exploit in about 40 minutes: it found a mismatch between the protocol's recorded deposits and the assets held by Treasury contracts. The Security Council then convened and paused the contracts.

“The reaction time was around forty minutes on this stuff…”—

MARKETS

Hacker Traceability — The guest argues that hackers can face liquidity difficulties and a high chance of being traced, particularly when a qualified counterparty is on the other side. He says they could ultimately be tracked to jail.

“But in general, this like hacking and, you know, stealing is not a very good thing. You're going to end up with lack liquidity…”—

NEAR Intents Exploit

Alex describes a bug in asynchronous cross-chain infrastructure that let an attacker create false deposit records and cause a loss of about $3.8 million.

Cross-Chain Protocol Design

Alex explains how NEAR Intents connects blockchains for swaps and why the exploit arose from interactions across multiple systems rather than one isolated contract.

Exploit Detection

The team noticed broken balance invariants through monitoring, paused affected contracts, and quickly committed to covering users’ losses if recovery failed.

Law Enforcement Response

After alerting law enforcement, the Security Council combined public information and internal logs to identify a likely connection and urge the suspected parties to return funds.

Tracing the Suspect

Alex says the team built a high-confidence case from online information and system logs but avoided publicly accusing anyone whose precise role remained uncertain.

Encrypted Recovery Channel

The team used a message encrypted to the attacker’s public key to establish private contact, where the attacker said they intended to return the funds, much of which had become Monero.

Bug Bounties Over Theft

Alex urges would-be attackers to report vulnerabilities through bug bounties, describing responsible disclosure as safer and more rewarding than stealing funds.

AI Hacks and Shield

Alex describes NEAR Intents’ Shield monitoring and compliance tools, which detect suspicious activity, slow risky transactions, and helped limit funds moving through the protocol.

Decentralization and Compliance

Alex argues that decentralized execution can coexist with safeguards against clearly stolen funds, while difficult boundary cases call for transparent governance and careful judgment.

Ownership and Crypto Value

Alex contends that protecting ownership and assigning responsibility are necessary for crypto assets to retain value and support a credible future financial system.

Privacy Coins and Zcash

The speakers discuss tracing limits for shielded assets and argue that preventing illicit funds from entering privacy protocols may help Zcash avoid the restrictions faced by Monero.