Who Is Alex Shevchenko? NEAR Intents GM and $3.8M Exploit Victim

Alex Shevchenko is the general manager of NEAR Intents, the swap engine behind near.com, whose volume in the four days starting with a 1 October 2026 exploit ran 31.61% below the same days a week earlier. The exploit took about $3.8 million, and he gave the exploiter 48 hours to return the funds.

DefiLlama's day values put NEAR Intents at $390.2 million for 1-4 October against $570.5 million for 24-27 September, after a September that grew 72.94% on August. NEAR's Phemex perpetual fell 9.99% on the 1 October bar as BTC rose 1.51%.

Who Is Alex Shevchenko?

Alex Shevchenko was Aurora Labs' CEO in 2022, and the company lists him as an adviser.

NEAR Intents, the network he runs, lets users name a swap across chains and has solvers compete to fill it.

NEAR Intents traced the exploit to a bug in its Omni deposit and withdrawal system, halted services and pledged full compensation.

How Did Alex Shevchenko Get to NEAR Intents?

Step 1: Aurora Labs CEO in 2022

Aurora's blog post of 12 September 2022 on Aurora updates named him Aurora Labs' CEO and credited him with announcing a batch of changes at NEARCON 2022. They included a Rainbow Bridge connector that let any NEAR-native token move to Ethereum, and cross-contract calls that let Aurora users reach any NEAR app from inside Aurora. Aurora runs Ethereum-style contracts on top of NEAR, the chain our explainer on what NEAR Protocol is breaks down.

Step 2: Aurora Labs Adviser

Aurora Labs' team listing on auroralabs.dev, read at 13:30 UTC on 5 October 2026, gives him the title Advisor and no date for the change. The same page describes Aurora Labs as the developer of Virtual Chains, EVM-compatible chains that run as smart contracts on NEAR.

Step 3: NEAR Intents General Manager

TokenPost and Crowdfund Insider both called him NEAR Intents' general manager on 2 October 2026, and neither report says when he took the job. NEAR Intents' original site at near-intents.org, read at 13:48 UTC on 5 October 2026, says the product has moved to near.com with the same technology and the same team. If you're new to the model, our guide to how NEAR Intents works walks through a swap from quote request to settlement. DefiLlama's NEAR Intents page files the network under Bridge and counts $32.23 billion of volume from 10 December 2024 through 4 October 2026.

Step 4: The 1 October Exploit Response

NEAR Intents posted at 12:53 UTC on 1 October 2026 that its services had stopped after a security incident caused by "a bug in the Omni deposit and withdrawal infrastructure interaction with NEAR Intents smart contract". Crowdfund Insider's report of 2 October says the team put the preliminary loss at about $3.8 million and pledged to compensate users in full. Core swaps were due back within about an hour, while deposits and withdrawals on eleven networks were due to stay offline for roughly twelve more hours. The team also referred the case to law enforcement. NEAR co-founder Illia Polosukhin said the bug touched only USDT on BSC.

Alex Shevchenko then took the NEAR Intents response public. TokenPost's report at 02:27 UTC on 2 October says he announced the team had identified the person responsible and gave them 48 hours to send the funds back, posting return addresses for BTC, BNB and SOL. He framed the deadline as a final chance to return the funds through responsible disclosure.

The Numbers Behind NEAR Intents

Method: every volume figure is a settled DefiLlama day value for NEAR Intents, read at 13:34 and 13:46 UTC on 5 October 2026 with identical results. Each percentage comes from the two exact dollar figures, and price moves are Phemex perpetual daily closes.

The four days starting on the exploit day made the smallest Thursday-to-Sunday total since 27-30 August, when NEAR Intents moved $368.76 million. The slide started before 1 October, though, because the 24-27 September block was already 26.51% below 17-20 September. So the exploit landed on volume that was cooling, and the following four days cooled faster.

NEAR's price needs the same control. NEAR Intents' status page logged a 1Click API incident at 09:13 UTC on 1 October. The perpetual's last hourly close before it was 5.216, 2.29% below its 30 September close. By 12:00 UTC it was 4.25% lower, 53 minutes before NEAR Intents' post. It finished the bar 9.99% lower, so about 23% of the drop came before the status page's entry. Among seven large perpetuals we checked on that bar, only ICP fell (-1.42%) and BTC's 1.51% gain led the rest. NEAR's own fall was real, and the hourly bars won't pin all of it on the exploit.

Why Alex Shevchenko's Story Matters Beyond NEAR

For founders: A 48-hour deadline with published return addresses gives an exploiter a defined way out, and NEAR Intents set it on top of a law-enforcement referral it had already made. DefiLlama logs the 1 October loss as a bridge hack on BSC, in a year when crypto hack incidents rose 50% in the first half.

For investors: DefiLlama's methodology notes say that since 23 February 2026 NEAR's captured Intents revenue has gone to buying NEAR on the open market. That revenue starts as fees on the swaps in the table above, so the network's volume feeds the token's buybacks.

For traders: NEAR's perpetual climbed 178.17% in September, from 1.919 on 31 August to 5.338 on 30 September, the same month NEAR Intents' volume grew 72.94%. The exploit arrived the next day. If you hold NEAR for its AI thesis, our comparison of NEAR and Akash as AI compute plays covers that side of the trade.

What Traders Should Watch

The volume rebound: DefiLlama's 8-11 October block is the first like-for-like test against the $390.16 million of 1-4 October and the $570.48 million a week before that.

The incident report: Crowdfund Insider says NEAR Intents promised a fuller public account of the bug. NEAR's blog index, read at 13:32 UTC on 5 October 2026, lists no incident post. The NEAR Intents status page, read at 13:39 UTC on 5 October 2026, still shows a 1Click API incident detected at 09:13 UTC on 1 October with no later update.

The compensation terms: The first post gave no payment schedule or affected-account list for the $3.8 million, according to Crowdfund Insider.

The NEAR level: The perpetual closed 4 October at 4.913, still 7.96% below its 30 September close of 5.338. That was NEAR's last close before the exploit day, and getting back above it would erase the 1 October drop.

How to Trade the Trends Alex Shevchenko Represents

Via crypto: Phemex's product list, read at 13:34 UTC on 5 October 2026, shows the NEAR / USDT perpetual and the NEAR / USDT spot pair as Listed. The perpetual lets you take either side of NEAR after news like this, and the 1 October bar shows how far it can move against the majors in one day.

Via supply: NEAR Intents' volume is one input and NEAR's issuance is the other, which our comparison of which of Bittensor and NEAR dilutes holders faster sets out after both networks cut their issuance in late 2025.

Frequently Asked Questions

Who runs Aurora Labs after Alex Shevchenko stepped back?

Aurora Labs' team listing, read at 13:30 UTC on 5 October 2026, names Declan Hannon as CEO and lists Shevchenko as an adviser.

Did the NEAR Intents exploit break the NEAR blockchain itself?

Crowdfund Insider places the defect in the Omni deposit and withdrawal path's interaction with the Intents contract, with no failure of the NEAR chain underneath.

How did NEAR Intents detect the exploit?

Illia Polosukhin said an internal monitoring layer called SHIELD flagged the unusual activity and prompted the halt, and that the team fixed the bug within an hour of detection.

Which networks lost deposits and withdrawals after the exploit?

Crowdfund Insider lists eleven networks, among them BSC and TON. Users already holding those chains' assets inside NEAR Intents were told they could still swap them once the core service returned.

What can traders learn from Alex Shevchenko and NEAR Intents?

Read a protocol's volume as closely as its token. NEAR Intents' busiest day in DefiLlama's series was 17 September 2026, at $303.42 million, two weeks before the exploit.

Disclaimer: This article is for informational purposes only and is not financial advice. Cryptocurrency trading involves substantial risk. Always do your own research before making investment decisions.