How NEAR Intents Identified a Suspect and Got Its Stolen Funds Back
How NEAR Intents Identified a Suspect and Got Its Stolen Funds Back
1 hour ago•Unchained•Laura Shin
Podcast46 min
Listen to Episode
Note: AI-generated summary based on third-party content. Not financial advice. Read more.
Quick Insights

The insights offer no specific buy/sell calls or price targets, so treat NEAR Intents as a high-risk infrastructure opportunity to monitor rather than a clear trade: reported scale is substantial, but repeated security incidents make resilience and incident response key. Before using 1inch Aqua or any cross-chain service, assess how funds are handled and what protections exist; liquidity provision and cross-chain transfers can lose money, and returns are not guaranteed. Approach XMR and ZEC cautiously, as exchange restrictions and regulatory scrutiny could limit access, particularly for privacy-focused assets.

Detailed Analysis

NEAR Protocol / NEAR Intents

  • NEAR Protocol is a layer-1 blockchain; NEAR Intents is an application built on it that connects blockchains for cross-chain swaps and other financial uses.
  • The guest said NEAR Intents processes about $200 million in daily volume and serves roughly 50% of cross-chain swapping volume, excluding stablecoin bridging and some other activity. These are the guest’s estimates.
  • A vulnerability in the protocol’s cross-chain infrastructure led to about $3.8 million in losses. The team said it replenished the affected smart-contract balances with its own funds while the stolen assets, which had been converted into Monero (XMR), remained a separate recovery and conversion challenge.
  • The guest also cited a prior incident involving approximately $20 million taken from the NEAR ecosystem, underscoring that security incidents have occurred more than once.
  • The team described Shield, a system intended to detect suspicious activity and blockchain disruptions. During the Bitget hack, it reportedly identified more than $50 million in related funds attempting to pass through NEAR Intents; about $166,000 passed through, while roughly $500,000 was stopped mid-execution.

Takeaways

  • NEAR Intents’ claimed scale and wallet integrations point to an opportunity in cross-chain trading infrastructure, but the incidents described make protocol security and operational resilience central risks.
  • For anyone evaluating NEAR-related exposure, distinguish the NEAR blockchain from NEAR Intents and assess how the application’s security controls and incident response evolve. The transcript gives no price target or buy/sell recommendation.

1inch Aqua

  • The sponsor described 1inch Aqua as a shared liquidity platform that lets liquidity providers back multiple positions using the same token balance, with tokens remaining in the wallet until a swap fills.
  • The sponsor cited research commissioned by 1inch estimating that $540 million of concentrated liquidity sat idle in a given week in the first half of the year, or about 30% of DeFi total value locked.
  • The sponsor said the design may let liquidity providers cover more market conditions and pairs with their full balance. It also cautioned that providing liquidity carries risk and fees are not guaranteed.

Takeaways

  • Aqua represents a DeFi liquidity-management opportunity, but the claimed efficiency benefits do not eliminate the risks of liquidity provision or guarantee returns.
  • Consider the mechanics, potential losses, and fee uncertainty before providing liquidity. The transcript does not discuss a 1inch token price, target, or recommendation.

Monero (XMR)

  • The attacker’s funds were reportedly converted into XMR, making recovery and conversion more difficult. At the time of the interview, the guest said the protocol had replenished the affected balances but was still working through the XMR-related process.
  • The guest said Monero is available on only a handful of exchanges and is not traded on major exchanges, and warned that regulators may pressure centralized exchanges to restrict or delist privacy coins.
  • The guest also claimed that Monero’s volume of illicit transactions is several times its market capitalization. This was presented as his view, not as independently verified data.

Takeaways

  • The discussion highlights regulatory, exchange-access, and reputational risks for XMR, alongside its privacy features.
  • Any assessment of XMR should account for the possibility that access to centralized exchanges could become more limited. The transcript provides no price target or investment recommendation.

Zcash (ZEC)

  • The guest said shielded Zcash can be swapped through NEAR Intents and that metadata analysis—such as transaction amounts and timing—may help identify some links, though it is not fully reliable.
  • He said some funds connected to the Bitget hack were already in shielded Zcash and therefore remained difficult to trace.
  • The guest expressed hope that Zcash would grow while retaining protections against illicit activity. He warned that, if privacy coins become associated with substantial illicit use, regulators could pressure exchanges to restrict or delist them, as he said has happened with Monero.

Takeaways

  • Zcash presents a privacy-versus-regulatory-access investment theme: the privacy features may be valued by users, but they can also invite additional scrutiny.
  • The guest’s positive comments about Zcash were conditional on effective safeguards; they should not be read as a price forecast or a specific recommendation.

USDT (Tether)

  • USDT on BNB Chain was the asset targeted in the NEAR Intents exploit. The attacker’s transactions caused the infrastructure to record deposits that had not actually occurred.
  • USDT also came up as an example of a destination the team might use when converting recovered funds.

Takeaways

  • The incident points to cross-chain infrastructure risk, rather than a criticism of USDT itself.
  • Users should consider the bridge or swap protocol involved in moving stablecoins across chains, not just the stablecoin and its issuer.

BNB Chain

  • The exploit focused on BNB Chain and USDT. The guest described the issue as a flaw in the interaction of asynchronous, multi-chain components, rather than a simple spoofing attack.
  • The transcript does not discuss BNB token fundamentals or offer a view on its price.

Takeaways

  • The episode illustrates that assets on a chain can be exposed to risks in third-party bridges and cross-chain applications.
  • Treat chain exposure and the security of the services connecting chains as separate due-diligence questions.

Bitcoin (BTC)

  • Bitcoin was mentioned as an asset people can swap into ETH through NEAR Intents and as one of the chains for which the team published an address to receive returned funds.
  • The guest said the attacker’s funds were correctly identified on the Bitcoin blockchain, while other funds had been converted into XMR.

Takeaways

  • Bitcoin was discussed as part of cross-chain activity and fund tracing, not as an investment thesis. The transcript contains no price target or recommendation.

Ethereum (ETH)

  • The guest used Ethereum as an example of a blockchain where users need ETH to pay transaction fees.
  • BTC-to-ETH swaps were cited as an example of the cross-chain trading supported by NEAR Intents.

Takeaways

  • The discussion highlights ETH’s role in transaction fees and cross-chain trading, but does not provide a valuation view, price target, or recommendation.

Solana (SOL)

  • Solana was mentioned as a chain with an address listed for returning funds and in the context of cross-chain activity and the Drift hack.
  • The guest said NEAR Intents had taken countermeasures during the Drift incident to limit the movement of funds.

Takeaways

  • The comments point to the importance of monitoring and security tools across blockchain ecosystems. The transcript offers no direct investment view or price target for SOL.

Litecoin (LTC)

  • The guest said NEAR Intents’ Shield system detected degraded performance on the Litecoin network during an earlier incident and slowed or stopped some transactions. He said the system reduced losses during that incident by 80%.

Takeaways

  • The example highlights that network reliability can affect applications built to move assets across chains.
  • The transcript does not discuss Litecoin’s investment outlook, price target, or recommendation.

Cross-Chain DeFi and Security

  • The episode emphasized the growth of cross-chain swaps and liquidity services, alongside the difficulty of securing systems that coordinate transactions across multiple blockchains.
  • The guest said AI-assisted attacks had increased and described investment in monitoring tools to detect hacks, suspicious funds, and network problems.
  • He argued that stronger controls can help protect the value of on-chain assets, while acknowledging debate about the balance between those controls and permissionless access.

Takeaways

  • Security, monitoring, and compliance capabilities are important considerations when evaluating cross-chain DeFi services.
  • The opportunity in cross-chain infrastructure comes with risks from software vulnerabilities, network disruptions, illicit fund flows, and decisions about restricting transactions.
Ask about this postAnswers are grounded in this post's content.
Episode Description
A bridging bug cost NEAR Intents $3.8 million. Alex Shevchenko reveals how a coded tweet and a Signal invite encrypted with the attacker's key got the funds back. ======================================================== Thank you to our sponsor! ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Visit⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 1inch.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ to swap tokenized securities, crypto and more. Simple. Secure. Self-custodial. Whatever asset you’re buying - swap it at⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 1inch.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ======================================================== Quick favor: We're deciding what Unchained does next; new shows, stream times, what's worth paying for.⁠⁠⁠⁠⁠ Our listener survey⁠⁠⁠⁠⁠ takes five minutes, it's anonymous, and I read the write-in answers myself. Everyone who takes it can enter a drawing for a free year of Unchained Premium or Bits + Bips Premium. Open through Sunday, October 18. — Laura ======================================================== NEAR Intents halted services after an attacker exploited a bug in its Omni bridging infrastructure and walked off with $3.8 million. Twelve hours after announcing the hack, the team tweeted at the suspect: "We have identified you, sir." Alex Shevchenko, GM of NEAR Intents, joins Laura Shin to walk through how the attacker got the protocol to credit USDT deposits on BNB Chain that never happened, why NEAR Intents covered the loss from its own pockets, and how a Signal invite encrypted with the attacker's public key opened a private channel that ended with the funds coming back, partly in XMR. He also lays out how Shield, NEAR Intents' detection system, kept 99% of the more than $50 million tied to the Bitget hack from passing through, and why he thinks shielded Zcash could face Monero's fate. His argument: crypto that protects thieves can never become the economic backbone its builders want. Host: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Laura Shin⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, Host / Unchained Guest: ⁠Alex Shevchenko - GM of NEAR Intents Timestamps 🚨 01:43 How an Omni bridging bug let an attacker fake deposits and drain $3.8M 🌐 02:37 What NEAR Intents is, and how it relates to NEAR Protocol and near.com ⚙️ 05:01 How the hack worked and how the identified that it had occurred 💧 09:51 1inch Aqua: Back multiple positions with one token balance at https://1inch.com/aqua 🚔 10:55 Law enforcement, and how NEAR Intents identified a suspect within 12 hours 🔐 17:51 The Penn and Teller playbook: a Signal invite only the attacker could decrypt 🏎️ 22:52 Why Alex says a bug bounty beats hacking, Lambo included 🛡️ 26:24 Shield: how NEAR Intents kept 99% of Bitget hack funds off the protocol ⚖️ 32:07 Does blocking stolen funds make NEAR Intents centralized? Alex says no 🕶️ 40:17 Can shielded Zcash stay clean, or will it follow Monero's path? Learn more about your ad choices. Visit megaphone.fm/adchoices
About Unchained
Unchained

Unchained

By Laura Shin

Crypto assets and blockchain technology are about to transform every trust-based interaction of our lives, from financial services to identity to the Internet of Things. In this podcast, host Laura Shin, an independent journalist covering all things crypto, talks with industry pioneers about how crypto assets and blockchains will change the way we earn, spend and invest our money. Tune in to find out how Web 3.0, the decentralized web, will revolutionize our world. Disclosure: I'm a nocoiner.