The cross-chain protocol that stopped a North Korean hacking group got hacked itself 48 hours later, then got all its money back by doxxing the attacker.
The Summary
- NEAR Intents lost $3.8 million through a deposit/withdrawal bug on October 1st, days after blocking $50 million in stolen Bitget funds from being laundered through their platform
- General manager Alex Shevchenko identified the hacker and issued a 48-hour ultimatum, posting three Bitcoin addresses for the money's return
- The exploiter returned the entire sum, with about 34.59 BTC arriving at the published recovery wallet
- The hack exposed a critical tension in DeFi: protocols are expected to selectively censor North Korean state actors while remaining permissionless for everyone else
The Signal
On September 28th, NEAR Intents wore a white hat. Their SHIELD risk layer blocked over $50 million in attempted swaps tied to the massive Bitget hack, which saw $387.5 million stolen in what's become one of 2026's largest crypto heists. Bitget CEO Gracy Chen publicly praised the cross-chain protocol. The move drew a sharp contrast with THORChain, which maintains it does not selectively censor transactions.
Two days later, NEAR Intents was bleeding from its own wound. On October 1st, an attacker drained about $3.87 million USDT from a contract on BNB Chain over roughly six hours. The protocol immediately halted services, with deposits and withdrawals frozen across 11 networks. The bug affected the contract's deposit and withdrawal logic. The team patched it within an hour and pledged full user compensation.
"Hacks are never good, but a rapid response, user compensation and 1-hour bug fixing seems to top the spectrum of team reactions." — Decrypt
Then Alex Shevchenko, NEAR Intents' general manager and Aurora Labs co-founder, went public with a threat. On October 2nd, he posted: "We have identified you, sir." He gave the attacker 48 hours to return the funds to three specified addresses. None had received funds as of early October 2nd, but the clock was ticking.
It worked. The exploiter returned the entire sum after being identified. The published recovery wallet received about 34.59 BTC. NEAR Intents closed its investigation. Total time from exploit to full recovery: under 48 hours.
The sequence reveals a fundamental paradox in cross-chain infrastructure. NEAR Intents positions itself as a permissionless protocol, the kind of neutral rails Web3 promises. But "permissionless" is a marketing claim, not an operational reality. When $50 million in North Korean-linked funds tries to move through your contracts, you either stop it and get praised by exchange CEOs, or you let it through and face regulatory heat, user backlash, and reputational collapse.
Key tensions exposed:
- Cross-chain protocols are expected to KYC bad actors while remaining trustless for good ones
- The same on-chain transparency that enables censorship resistance also enables doxxing exploiters
- "Decentralized" infrastructure still relies on centralized decision-making when things break
The irony is sharp. NEAR Intents' compliance tools worked perfectly against a nation-state adversary but couldn't protect against a bug in their own contracts. Their SHIELD layer scans for stolen funds. It doesn't scan for logic errors. Meanwhile, the "permissionless" THORChain that refused to block the Bitget hackers didn't get exploited. Sometimes neutrality is a security model.
The Implication
If you're building cross-chain infrastructure in 2026, you're building compliance infrastructure whether you admit it or not. The NEAR Intents story shows both the power and the limits of that approach. Blocking $50 million in North Korean funds earns you goodwill. Getting hacked 48 hours later shows you're still just as vulnerable as everyone else.
The fast recovery is the real story. Forty-eight hours from exploit to full return is unheard of in DeFi, where hackers typically vanish into mixers and cross-chain bridges. Shevchenko's public identification gambit worked because on-chain transparency cuts both ways. The same tools that let you track stolen Bitget funds let you track the person who drained your contracts. Web3's supposed anonymity evaporates the moment someone with resources decides to look.
Watch for two things. First, expect more protocols to adopt SHIELD-like risk layers. The regulatory and reputational upside is too large to ignore, and NEAR Intents just proved it works. Second, watch how protocols handle the "selective permissionlessness" question. You can't be neutral infrastructure and also the sheriff. Pick one. The market will force that choice faster than teams want to make it.
Sources
Crypto Briefing | CoinTelegraph | The Defiant | Decrypt | BeInCrypto | Protos | CoinDesk | The Block | Unchained Crypto