NEAR Intents says it has identified the person behind a $3.8 million exploit and is giving the alleged hacker just 48 hours to return the stolen funds.

The cross-chain transaction protocol publicly confronted the individual on Friday, offering a final opportunity to return the cryptocurrency under a “responsible disclosure” arrangement. The ultimatum comes only days after NEAR Intents was itself involved in freezing funds linked to the much larger Bitget hack, putting the protocol at the center of an increasingly complicated debate over security, intervention and decentralization.

NEAR Intents gives alleged hacker 48 hours

NEAR Intents general manager Alex Shevchenko addressed the alleged attacker directly in an X post on Friday, saying the protocol had identified them and warning that the responsible-disclosure window was closing.

“We have identified you, sir,” Shevchenko wrote, before telling the alleged hacker that they had 48 hours to use the disclosure route before the opportunity expired.

Shevchenko also published three wallet addresses for returning the funds, covering Bitcoin, BNB and Solana. The unusually public message turns what would normally be a conventional crypto exploit disclosure into a direct confrontation between a protocol and the person it says was responsible.

The ultimatum follows a security incident that forced NEAR Intents to pause parts of its services on Thursday. The protocol said it had discovered a bug involving the interaction between its Omni deposit and withdrawal infrastructure and its smart contracts, with a preliminary investigation finding that approximately $3.8 million in user funds had been stolen.

NEAR Intents said it had patched the contract-side vulnerability and pledged to fully compensate affected users. Deposits and withdrawals across several networks remained unavailable while the wider Omni infrastructure was secured.

The stolen funds were quickly moved to Bitcoin

The alleged exploit did not leave the stolen assets sitting in one easily identifiable wallet.

Blockchain investigator ZachXBT reported that NEAR Intents’ BNB Chain hot wallet experienced irregular outflows before transactions stopped processing. He said the stolen funds were then transferred to the KuCoin exchange and bridged to Bitcoin, adding another layer to the investigation as the assets moved away from the network where the exploit occurred.

The movement highlights one of the defining characteristics of cross-chain crypto attacks: an exploit can begin with a vulnerability on one network but quickly become a multi-chain tracing exercise as the attacker moves assets between wallets, blockchains and exchanges.

For NEAR Intents, however, the latest attack carries an additional layer of irony.

Only days earlier, the protocol had been involved in efforts to stop cryptocurrency connected to the much larger Bitget hack. General Manager Shevchenko said approximately $50 million of the funds stolen from Bitget attempted to move through NEAR Intents.

According to Shevchenko, the protocol managed to freeze approximately $503,000, while about $166,000 was able to pass through its infrastructure. The remaining funds were sent through other providers.

That episode demonstrated that the infrastructure sitting between different blockchains can have a meaningful role in deciding what happens to suspicious assets. It also exposed a tension that now looks particularly relevant after NEAR Intents’ own exploit.

The hack puts NEAR Intents’ role in the spotlight

The Bitget incident had already raised questions about how decentralized cross-chain infrastructure can be when protocols have the ability to intervene in transactions involving allegedly stolen assets.

THORChain, for example, faced pressure to block funds associated with the Bitget attack but emphasized its decentralized and permissionless design rather than taking the same approach. The contrasting responses highlighted an ongoing conflict within crypto infrastructure: users want systems that resist centralized control, but they may also expect those same systems to act when criminals attempt to move stolen funds.

NEAR Intents has now experienced both sides of that equation within days.

The protocol helped freeze part of another hack before an attacker allegedly exploited its own infrastructure for millions of dollars. It then paused services, began investigating the vulnerability and promised to compensate affected users while attempting to recover the stolen assets.

That does not by itself establish whether NEAR Intents is centralized or decentralized. Instead, it illustrates the increasingly complex layers involved in modern crypto infrastructure, where permissionless blockchains can coexist with applications that have operational controls and emergency intervention mechanisms.

The immediate question is whether the alleged attacker will take NEAR Intents up on its 48-hour offer. But the larger story may be what the incident reveals about the infrastructure connecting crypto's fragmented ecosystem.

NEAR Intents wanted the ability to stop stolen funds when Bitget was attacked. Now it is relying on that same broader ecosystem — and its own security systems — to respond after becoming the victim itself.