# NEAR Intents manager says $3.8 million exploit funds were returned in full

Canonical: https://chainincident.com/news/7adf5fff-8d8f-4360-ab5d-cab623c6bc0d
Published: 2026-10-03T11:37:55.181Z
Publisher: Chain Incident

The October 2 statement announces recovery, while a complete public reconciliation and technical postmortem remain separate questions.

NEAR Intents general manager Alex Shevchenko said on October 2 that all funds from the service's reported $3.8 million exploit had been returned. His update adds a recovery claim to the October 1 incident, when the team stopped services after detecting a bug involving its Omni deposit and withdrawal infrastructure.

In his [public statement](https://x.com/AlexAuroraDev/status/2106049685928677585), Shevchenko also said the investigation was being stopped and asked researchers to use bug bounty channels. The statement does not include a complete transaction-by-transaction reconciliation of the returned amount. The full-recovery figure should therefore be understood as the team's account, rather than an independently reconstructed total.

The [original NEAR Intents notice](https://x.com/near_intents/status/2105642219357241796) describes an interaction between Omni infrastructure and the Intents smart contract as the source of the incident. [Earlier reporting by crypto.news](https://crypto.news/near-intents-resumes-service-after-3-8m-exploit/), citing NEAR co-founder Illia Polosukhin, identifies USDT on BNB Chain as the affected asset and network. It also separates the incident from the core NEAR blockchain and its native token.

The service had pledged full compensation to affected users. That promise and the subsequent announcement that stolen funds were returned are different milestones: a recovery statement alone does not document when each affected user's balance was restored.

The [iTokenly incident registry](https://itokenly.com/hacks/near-intents-omni-october-2026) likewise attributes full recovery to the team's statement. Its account distinguishes the publicly described Bitcoin transfers from portions of the return that were not fully explained. This publication has not independently audited those flows.

For users following the event, the remaining useful evidence is a technical postmortem explaining the failure, the fix and any continuing restrictions. Returning funds resolves a financial question; it does not by itself establish that the same infrastructure cannot fail again.

The recovery announcement should also not be read as confirmation that every connected network is operating without restrictions. Users need the service's current status for that separate question. The new development is the manager's explicit full-return statement, with the limits of its supporting public evidence kept visible.

## Sources

- [NEAR Intents recovery registry and evidence limits](https://itokenly.com/hacks/near-intents-omni-october-2026) — iTokenly
- [NEAR Intents reports Omni infrastructure incident](https://x.com/near_intents/status/2105642219357241796) — NEAR Intents
- [NEAR Intents restarts service and pledges compensation](https://crypto.news/near-intents-resumes-service-after-3-8m-exploit/) — crypto.news
- [NEAR Intents manager says funds returned in full](https://x.com/AlexAuroraDev/status/2106049685928677585) — Alex Shevchenko

- [Editorial policy](https://chainincident.com/editorial-policy)
- [Request a correction](https://chainincident.com/corrections)