The attacker who drained about $3.8 million from NEAR Intents returned only part of it in Bitcoin, the protocol’s general manager said on Unchained. The rest came back in Monero (XMR), and the team is still working out how to convert it.
Alex Shevchenko, GM of NEAR Intents, walked through the return in an episode recorded Oct. 8. After the Oct. 1 exploit, his team tracked the stolen assets and believed the non-Bitcoin portion was still sitting on Ethereum, BNB Chain and Solana. It was not. “So everything was correctly identified on the Bitcoin blockchain,” Shevchenko said on the show, but the other assets had moved through hard-to-trace channels, and “in fact they have been traded into XMR.”
That changed what the attacker needed from NEAR Intents. One reason the attacker made contact, Shevchenko said, was to learn “what is the Monero address to return the funds.”
Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.
Funds Back, Conversion Pending
On Oct. 2, Shevchenko posted that the funds “were sent back in full” and that the team was ending its investigation, as Unchained later reported. That day, independent onchain analyst Kuncoro checked the published return addresses and found the Bitcoin one received 34.59 BTC, about 78% of the total, concluding the rest “came back through a different” route; Shevchenko replied, “You are right. It did indeed.” Asked whether NEAR Intents still held the XMR, he said “this part is in process.”
The team has already replenished its smart contracts from its own funds, Shevchenko said, so the remaining step is to “return money back to the pockets.” That means converting the XMR into USDT, and he said companies have raised questions. “They’re asking for the source of funds, and what are we gonna say the source of funds?” he said on the show. Shevchenko did not say how much of the return arrived in XMR. He added that his first time handling the coin “was exactly during the hack.”
An Invite Only the Attacker Could Open
Shevchenko also explained how the two sides got a private line. After the attacker sent an onchain message offering to cooperate and asking for a Signal contact, Shevchenko posted an encrypted message holding a Signal group invite. Only the attacker could read it, because “this encrypted message was encrypted with the public key of the attacker,” he said on the show, which left the attacker as “the only person who is able to decrypt it.”
He also repeated his call for hackers to use bug bounties instead. Since the exploit, NEAR Intents has received several submissions, and one of them was valid and will be paid, Shevchenko said.
Related Listen: How NEAR Intents Identified a Suspect and Got Its Stolen Funds Back
The post NEAR Intents’ General Manager Says Part of the $3.8 Million Exploit Came Back in Monero appeared first on Unchained.