Near Intents, a cross-chain swap service, halted operations after an attacker drained around $3.8 million by exploiting a bug in its Omni layer.
The next day, Near Intents posted addresses for returning the funds and threatened the attacker: "We have identified you, sir." The attacker returned everything the next day, in a transaction that included an on-chain message saying "We've returned all the funds, we were in the wrong". Near Intents confirmed the funds were returned, and said they were stopping their investigation.