NEAR Intents' $3.8M Exploit Funds Came Back in Bitcoin and Monero (XMR)

$3.8M Drained, Returned as XMR

Most of the $3.8 million an attacker drained from NEAR Protocol (NEAR) Intents on October 1 has come back, but not in the form the protocol's team expected. Alex Shevchenko, general manager of NEAR Intents, said in a recording dated October 8 that only a slice of the stolen funds returned in Bitcoin. The remainder, he said, had been traded into Monero (XMR), the privacy coin whose ledger does not name senders or receivers. The disclosure has no direct bearing on the Monero price itself, but it puts the coin at the center of one of the more unusual recoveries of the quarter. NEAR Intents runs a cross-chain swap protocol that lets users trade assets across networks without wrapped tokens, and the October 1 exploit hit exactly that machinery. After the theft, the team tracked the stolen assets and initially believed the non-Bitcoin portion was still sitting on Ethereum, BNB Chain and Solana. That assumption did not hold. “So everything was correctly identified on the Bitcoin blockchain,” Shevchenko said, but the other assets had moved through channels that resist tracing, and “in fact they have been traded into Monero (XMR).” Monero obscures transaction parties at the protocol level, and its privacy stack, which includes Kovri, a network-layer anonymity project, is built so that amounts and counterparts never surface in public records. The rerouting also changed the negotiation. One reason the attacker made contact at all, Shevchenko said, was to settle a practical question: “what is the Monero address to return the funds.” A Bitcoin address let the team watch deposits land in plain sight; a Monero address offered no such window, which left the protocol waiting on the attacker's goodwill for the bulk of the take. Exploits of this size rarely end in full recovery, and the fact that this one has makes the mechanics worth unpacking.

Funds Back on October 2, Conversion Pending

The return itself closed quickly. On October 2 Shevchenko posted that the funds “were sent back in full” and that the team was ending its investigation. The same day, independent on-chain analyst Kuncoro checked the published return addresses and found that the Bitcoin address had received 34.59 BTC, about 78% of the stolen total, concluding that the remainder “came back through a different” route. Shevchenko confirmed the discrepancy: “You are right. It did indeed.” Asked whether NEAR Protocol (NEAR) Intents still held the XMR, he said “this part is in process.” The team has already replenished its smart contracts from its own funds, so the remaining step is to “return money back to the pockets.” That means converting the Monero into USDT, and the detour into privacy-focused Monero is exactly what makes that conversion slow. “They're asking for the source of funds, and what are we gonna say the source of funds?” Shevchenko said of counterparties handling the swap. Moving value from Monero's chain into a token on another network is the problem an atomic swap exists to solve, but the practical route here runs through venues that ask questions first. Shevchenko did not say how much of the take arrived in XMR, and he noted his first hands-on experience with the coin “was exactly during the hack.” The two sides had kept a private line open throughout. After the attacker sent an onchain message offering to cooperate and asking for a Signal contact, Shevchenko posted an encrypted message holding a Signal group invite. Only the attacker could read it, because the message “was encrypted with the public key of the attacker,” which left the attacker “the only person who is able to decrypt it.” Since the exploit, NEAR Protocol (NEAR) Intents has received several bug bounty submissions, and one of them was valid and will be paid.

The XMR Off-Ramp Is the Bottleneck

The on-chain record and the team's own posts make this one of the better-documented exploit recoveries: 34.59 BTC sits visible at the published address, and the shortfall is acknowledged in writing. What the case also shows is the standard post-theft exit into Monero, and the friction that follows it. The XMR share is back with NEAR Intents, undisclosed in size, and every off-ramp now demands source-of-funds proof the team can barely supply for coins an attacker handed over. Readers tracking the coin's chart can follow our Monero technical analysis; readers new to the privacy mechanics behind this episode can start with a guide on how to use Monero. The recovery story, for now, ends at NEAR Intents' conversion desk.