NEAR Intents Identifies $3.8M Hacker, Gives Them 48 Hours to Return Funds

How NEAR Intents Tracked the Exploit Across Chains

A security breach targeting USDT on the Binance Smart Chain has been traced to an individual by NEAR Intents, who has issued a 48-hour ultimatum for the return of stolen funds. The incident occurred recently, with the exploit confined to a specific token on a separate blockchain, leaving the NEAR protocol and its native token unharmed. NEAR Intents, a layer built on NEAR for cross-chain transaction execution, detected the anomaly through its monitoring systems and confirmed the scope of the breach.

The attack involved unauthorized movement of USDT tokens on BSC, amounting to approximately $3.8 million in value. Despite the cross-chain nature of the exploit, NEAR Intents emphasized that the core NEAR blockchain remained secure due to its architectural separation from BSC. Investigators used on-chain analytics to trace the transaction flow to a specific wallet address, which they claim belongs to the hacker. The team stated they are not seeking legal action at this stage but prefer voluntary restitution to avoid further complications.

Will the Hacker Comply With the Deadline?

Using its intent-based transaction monitoring, NEAR Intents observed unusual approval and transfer patterns originating from a known contract on BSC. The system flagged the activity after detecting a mismatch between expected and actual USDT flows linked to a recent smart contract interaction. By correlating timestamps and gas patterns, analysts narrowed the source to a single actor. The team noted that while NEAR itself was not involved, its interoperability tools allowed visibility into the BSC event through relayed data.

NEAR Intents has not disclosed whether any communication has been established with the wallet holder, but confirmed the 48-hour window began immediately after identification. The message was sent via an on-chain note to the address, a method chosen to ensure direct receipt without relying on off-chain channels. If funds are not returned, the team said they may consider public disclosure of the identifier or collaborate with blockchain analytics firms. They stressed that no user funds held in NEAR Intents vaults were at risk during the incident.

Was the NEAR blockchain compromised in this attack? No, the core NEAR network and NEAR token were not affected, as the exploit was isolated to USDT on the Binance Smart Chain.

Frequently Asked Questions

How did NEAR Intents identify the hacker if the attack happened on BSC? Through its cross-chain monitoring capabilities, NEAR Intents detected anomalous transaction patterns linked to the exploit and traced them to a specific wallet using on-chain analytics.

What happens if the funds are not returned within 48 hours? NEAR Intents may pursue further steps such as public identification of the address or collaboration with security firms, though it prefers a voluntary return to resolve the matter swiftly.