Episode Summary
Executive Summary: Near Intents GM Alex Shevchenko explains a $3.8 million exploit caused by a complex asynchronous bug in its cross-chain infrastructure, the rapid response and user reimbursement, and an ongoing effort to recover funds converted to Monero. He also describes SHIELD, a system for detecting suspicious activity, and argues that protocols should block clearly stolen funds while preserving room for decentralized governance and responsible privacy.
Main Topics: How the Near Intents exploit worked: An attacker targeted USDT on BNB Chain and exploited a flaw in coordination between Near-side contracts and the protocol’s multi-chain Omni infrastructure. The system recorded deposits that had not actually occurred. Shevchenko characterized it as a code vulnerability involving asynchronous components, rather than a simple spoofing attack. Incident response, reimbursement, and fund recovery: The team detected broken accounting invariants, halted affected operations, and responded in about 40 minutes. Shevchenko said the protocol replenished the contracts from its own funds because the bug was its responsibility. Some stolen funds were converted to Monero, making recovery and conversion more complicated; that process remained ongoing during the interview. Investigation and responsible disclosure: The Security Council reviewed public information and internal logs, contacted law enforcement, and privately approached a person linked by evidence to the exploit. Shevchenko stressed that these were suspicions, not proof of individual guilt, and said the priority was recovering users’ funds. He urged vulnerability finders to use bug bounties instead of disrupting services. SHIELD and monitoring illicit activity: Shevchenko described SHIELD as an internal risk-detection system that monitors hacks, suspicious transfers, and blockchain performance. It can reject or pause activity for review. He cited its response to the Bitget hack and a Litecoin performance incident as examples of limiting exposure. Decentralization, censorship resistance, and rules: Shevchenko argued that decentralization and transaction rules are separate questions. He said no single party can stop Near Intents execution, while SHIELD and a multi-signature compliance council apply rules against clearly stolen or otherwise severely harmful funds. He acknowledged the harder moral questions around sanctions and governance. Privacy coins and regulatory risk: The discussion considered whether shielded Zcash can be screened through metadata analysis and how privacy protocols may attract illicit activity. Shevchenko warned that regulators could pressure exchanges and other access points if a privacy asset becomes strongly associated with crime, as he believes has happened with Monero.
Key Arguments: Cross-chain protocols have a broader and more complex attack surface than a single-chain smart contract: asynchronous interactions among contracts and chain-specific infrastructure can create vulnerabilities even after repeated audits. Because the exploit arose from a protocol bug, the team considered compensating users its responsibility and replenished the affected contracts with its own funds rather than shifting the loss to users. Shevchenko said the investigation’s purpose was fund recovery, not public accusation; correlations and technical evidence were not equivalent to a court finding about who personally carried out the attack. Vulnerability disclosure through bug bounties is preferable to theft: it can reward researchers, improve security, and avoid harming users or creating difficulties converting and using stolen assets. Risk controls can help contain damage across interconnected chains. Shevchenko said SHIELD detected suspicious flows and blocked or paused most funds linked to the Bitget hack that attempted to pass through Near Intents. Shevchenko argued that enforcing rules against clearly stolen funds does not automatically make a system centralized; in his view, decentralization concerns who has unilateral control, while rules and governance concern what behavior the system permits. He maintained that permissionless systems still need ways to protect ownership and economic value, while acknowledging that deciding how to treat ambiguous cases requires broader governance and judgment. Privacy-enhancing systems may remain more viable if access points prevent clearly illicit funds from dominating their activity; otherwise, regulators may respond by pressuring centralized exchanges and other gateways.
Data Points: Near Intents exploit loss: $3.8 million - The reported loss from the incident involving the BNB Chain and USDT. Incident response time: Approximately 40 minutes - Shevchenko’s estimate of the time taken to react after the exploit began. Typical value moving through Near Intents: Approximately $200 million; 1–3 transactions per second - Shevchenko’s description of the protocol’s sustained daily operating load. Share of cross-chain swap volume: Approximately 50% - Shevchenko’s estimate for Near Intents, excluding stablecoin bridging and certain ETH movements between L2s and mainnet. Earlier publicly discussed Near ecosystem theft: Approximately $20 million in April - Shevchenko cited this earlier incident as another recovery effort; he said the funds were returned. Funds linked to the Bitget hack that attempted to pass through Near Intents: More than $50 million - Shevchenko said SHIELD identified this activity. Bitget-linked funds paused during execution: Approximately $500,000 - Funds the system reportedly locked while transactions were in progress for compliance review. Bitget-linked funds that passed through Near Intents: Approximately $166,000 - Shevchenko said this amount completed execution before the system could stop it. Reported Bitget-related containment: Approximately 99% kept outside the protocol; approximately 1% frozen mid-execution - Shevchenko’s characterization of SHIELD’s performance on attempted flows; he said the team wanted the amount passed through to be zero. Reduction in losses during a Litecoin incident: 80% - Shevchenko said SHIELD detected degraded Litecoin performance and reduced Near Intents’ losses in that incident. Potential recovery suspect group size: No more than 30 people - Shevchenko said he privately described a system or tool to a person he believed might help identify activity, saying he thought its users numbered at most 30.
Pivotal Quotes: "I'm a simple guy, I just would like the money of our users to be returned, and that's my primary goal." — Alex Shevchenko: He explained why the team contacted a suspected actor and emphasized that recovering users’ funds mattered more than publicly identifying or punishing someone. "Please use bug bounties, do good stuff instead of disrupting the services." — Alex Shevchenko: His appeal to people who discover vulnerabilities to report them responsibly rather than exploit them. "I do stand very strongly on the point that there are black money and there are white money and we need to do everything that is possible in order to block black money and in the middle let's figure out together how we are able to properly govern this" — Alex Shevchenko: His position on blocking clearly illicit funds while leaving difficult borderline cases to collective governance.
Implications: Cross-chain services need monitoring and response plans alongside audits, and reimbursement policies can shape user trust after exploits. SHIELD illustrates a trade-off facing crypto: limiting clearly illicit flows may protect users and value, but raises difficult questions about privacy, censorship resistance, and who sets the rules.