A hacker who drained NEAR Intents of $3.8 million is now on the clock. The co-founder of Aurora has publicly declared that the team knows the identity of the attacker and has issued a blunt ultimatum: return the stolen funds within 48 hours or face the consequences. It is a high-stakes gambit that has become an increasingly common playbook in crypto exploit response — but one that rarely plays out without drama.
The exploit targeted NEAR Intents, a protocol operating within the NEAR blockchain ecosystem designed to facilitate cross-chain transaction routing and intent-based execution. While the technical mechanics of the breach have not been fully detailed in public disclosures, the outcome is unambiguous: $3.8 million in assets was removed from the protocol in what appears to be a deliberate and sophisticated attack. Losses of this scale, while not record-breaking by the standards of decentralized finance (DeFi) exploits, are significant enough to threaten user confidence and protocol liquidity in the short term.
What makes this incident notable is not just the theft itself but the speed and directness of the response. Aurora's co-founder took to public channels to announce that the team has successfully identified the person responsible. In the world of pseudonymous blockchain transactions, this kind of claim carries weight — and risk. If the identification is accurate and provable, it transforms the situation from an anonymous hack into a traceable crime. If the claim is bluster, it risks undermining the team's credibility at precisely the moment when protocol users need reassurance.
The 48-hour window is a tactic the crypto industry has seen before. It borrows from the bounty and white-hat negotiation model that emerged during earlier DeFi exploit cycles, where development teams would publicly offer attackers a portion of stolen funds in exchange for returning the remainder, while simultaneously threatening legal action or on-chain tracing if the offer was refused. The calculus for the hacker is straightforward: return the money now with some plausible deniability, or face an increasingly coordinated response involving blockchain analytics firms, law enforcement referrals, and exchange-level flagging of associated addresses.
Whether the attacker complies depends heavily on how exposed they actually are. Blockchain forensics have matured dramatically over the past several years. Firms specializing in on-chain tracing can often de-anonymize wallets by correlating transaction patterns across exchanges, mixer services, and bridging protocols. If Aurora's team has genuinely identified the individual — rather than narrowed the field to a suspect cluster — the attacker's options for laundering or safely withdrawing $3.8 million become extremely limited. The 48-hour deadline may therefore represent a genuine off-ramp rather than an empty threat.
It is worth noting the structural relationship between Aurora and NEAR. Aurora is an Ethereum-compatible layer built on top of the NEAR Protocol, meaning its co-founder carries institutional credibility within the broader NEAR ecosystem. An identification claim made by a peripheral or unrelated actor might be dismissed; coming from someone with deep infrastructure access and technical standing in the network, it carries considerably more weight. It signals that the response is coordinated at an ecosystem level, not just a panicked reaction from a single protocol team.
For the wider DeFi sector, this episode reinforces two uncomfortable realities. First, intent-based execution layers — among the newer architectural patterns gaining traction in multi-chain environments — are becoming active targets as their total value locked grows. NEAR Intents represents the frontier of this design space, and a successful exploit at this layer demonstrates that security auditing must keep pace with architectural innovation. Second, the public identification strategy, while bold, introduces reputational and legal complexity for the teams deploying it. Naming a hacker without absolute certainty of identity could expose a team to defamation claims or taint potential criminal proceedings.
What This Means
The next 48 hours will determine whether Aurora's co-founder's gambit pays off. If the $3.8 million is returned, it validates the ecosystem's growing capacity for rapid forensic response and off-chain negotiation — a meaningful signal to institutional participants considering exposure to NEAR-adjacent infrastructure. If the funds do not return, the protocol faces a harder road: potential legal escalation, user redemption pressure, and the reputational cost of a breach that was publicly unresolved. Either way, the incident underscores that in 2026, the idea of anonymous crypto crime is eroding faster than many attackers appear to anticipate. The blockchain remembers everything, and increasingly, so do the people building on top of it.
Written by the editorial team — independent journalism powered by Bitcoin News.