NEAR Intents reports full recovery of stolen funds after ultimatum

Cointelegraph reports NEAR Intents recovered the full $3.8M taken in a reported exploit after issuing an ultimatum, but the headline is all that's confirmed so far.

Cointelegraph reports that NEAR Intents recovered the entire $3.8M taken in a reported exploit, after the protocol issued an ultimatum to the party holding the funds. That is the full extent of what has been published. No dates, addresses, transaction details, or account of how the ultimatum was delivered or accepted have been reported.

What this means for anyone tracking it

Headline-only reporting on a recovery is a common moment for compliance teams to get ahead of a story, and also a common moment to get it wrong. A claim of full recovery says nothing yet about how the funds moved, whether they passed through intermediary wallets or mixers first, or whether the recovery was verified on-chain by anyone outside the protocol's own statement.

For analysts and investigators, the gap between a headline and a forensic record matters. 'Recovered' can mean returned directly, recovered via a negotiated transfer, or recovered through some other mechanism entirely, and each has different implications for how the incident should be logged and whether related addresses need monitoring.

What is actually known right now

• Cointelegraph reported the headline claim on 2026-10-03.
• The amount cited in the headline is $3.8M.
• NEAR Intents is reported as the party that recovered the funds.
• An ultimatum to the party holding the funds is cited as the reported cause of the recovery.

What is not yet known

• The original exploit mechanism and timing.
• Any wallet addresses, transaction hashes, or chains involved.
• Terms or content of the reported ultimatum.
• Whether the recovery has been independently confirmed on-chain beyond the report itself.

Treat this as a developing story with a single confirmed source. Don't attribute unreported details to it, and don't assume the recovery mechanism matches any pattern from other incidents until Cointelegraph or another outlet publishes specifics.

Until on-chain details surface, the practical step is to watch for a follow-up report naming addresses or transaction hashes, then check those flows independently rather than relying on the recovery claim alone.

WalletDNA's wallet-flow tools let you check any addresses that do surface against this incident once they're published, so you're not starting from zero when the details arrive.