News linked to both this project and an event.
According to Cointelegraph, Alex Shevchenko, General Manager of NEAR Intents, stated that the team has identified the hackers behind the previous security incident and given them a 48-hour deadline to return the stolen funds through a "responsible disclosure." NEAR Intents previously suspended its services due to a vulnerability in the interaction between the Omni deposit and withdrawal infrastructure and its smart contracts. Initial investigations revealed that approximately $3.8 million in user funds were stolen in the incident, and the team has committed to fully compensating affected users. On-chain detective ZachXBT stated that the stolen funds were subsequently transferred to KuCoin and cross-chain converted into Bitcoin.
Odaily News: NEAR Intents has stated that it has identified the attacker responsible for the loss of user funds and has demanded the return of $3.8 million within 48 hours through a "responsible disclosure" mechanism, after which the window will be closed.NEAR Intents suspended services on Thursday after discovering a vulnerability in the interaction between the Omni deposit and withdrawal infrastructure and its smart contracts. A preliminary investigation showed that the attack resulted in the theft of $3.8 million in user funds, and the platform has committed to fully compensating affected users.On-chain investigator ZachXBT disclosed that the related funds were transferred to the KuCoin exchange and subsequently bridged to Bitcoin. (Cointelegraph)
Odaily News: According to Bitcoin News monitoring, DART stated that it and independent white-hat researchers have recovered over 50 BTC from wallets affected by the COLDCARD entropy vulnerability, completing the transfer before malicious attackers could steal the funds. DART is a digital asset recovery organization that works with white-hat researchers to protect vulnerable funds and coordinate their lawful return to owners. The white-hat researchers did not request a bounty and will return the Bitcoin to its owners.The rescued BTC has been transferred to the Crypto Recovery Trust. This trust is a dedicated statutory trust established under Wyoming state law to hold recovered digital assets and return them after confirming and verifying the legitimate owners. The trust will document the recovery process, separate the BTC from DART and researchers' funds, conduct blockchain analysis, ownership verification, and sanctions screening, and provide a lawful return process for verified owners. If ownership is disputed, or if the relevant funds involve sanctions or criminal proceedings, the BTC will be handled in accordance with applicable legal procedures. DART stated that other vulnerable assets and recovery leads are still under review.
According to CoinDesk, since the Coldcard hardware wallet vulnerability incident erupted on July 30, the wallet address associated with the hackers (bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r) has received multiple Bitcoin transfers accompanied by text messages. The wallet currently holds approximately $36 million in stolen assets, and confirmed losses from this incident have exceeded $100 million. The aforementioned information was written on-chain via Bitcoin's OP_RETURN function and permanently stored on the blockchain. The content covers victims' pleas for compensation (such as "You stole, please return some," "Return 80% of my 5 BTC"), solicitations for money laundering services ("I launder BTC, taking a 10% commission," with Telegram contact information included), and even fundraising requests completely unrelated to the incident, varying in nature.
According to Decrypt, an anonymous cryptocurrency whale filed a lawsuit against Coinbase this week in the U.S. District Court for the Northern District of California, accusing the exchange of refusing to return over $55 million worth of DAI stablecoins stolen in a phishing attack in 2024. The plaintiff claims to have engaged multiple on-chain investigation firms to trace the funds, ultimately identifying that the stolen assets flowed into a Coinbase account. Coinbase confirmed in December 2024 that it had frozen the relevant assets but refused to return them, citing the need for a court order. As of today—more than a year and a half after the incident—the victim has still not recovered the assets and has therefore turned to litigation. The attack was carried out by hackers using the “Inferno Drainer” tool to spoof the DeFi Saver login page; after the victim inadvertently interacted with the fake page, their wallet was fully compromised by the attackers.