NEAR Intents says it recovered its $3.8 million in full, Drift's claim token currently redeems for about 1 cent, and Bitget's chief executive does not expect to recover much of $388 million.
Crypto · FinancialMarkets.com · October 2, 2026 · Tickers: NEAR, BGB, DRIFT
Three recovery efforts reached milestones this week, and their outcomes span the full range of what crypto users can expect after a hack.
NEAR Intents: returned
NEAR Intents, the cross-chain swap service that lost about $3.8 million to an exploit on Oct. 1, said the funds have been returned in full, according to General Manager Alex Shevchenko. The service had said it identified the attacker and set a 48-hour deadline for the return.
The team had published a bitcoin address for returned funds. It has received about 34.59 bitcoin, worth about $2.94 million at Friday's price. The remainder would have to have been returned on other networks, and the full tally rests on the company's statement.
Drift: about a cent
Drift, a decentralized trading protocol drained of about $295.4 million in April, opened claims this week through a recovery token called DFX. Each verified dollar of USDT lost receives one DFX, with a fixed supply of about 299.5 million tokens.
The pool backing those tokens holds about 3.11 million USDT. That gives each DFX a current redemption value of about 0.0104 USDT, a little over 1 cent per dollar lost. Early claimants have redeemed 216,480 DFX for about 2,250 USDT. A sweep of protocol revenue into the pool has added 31 USDT so far.
Larger commitments sit outside the pool. Tether has committed up to 127.5 million USDT, which Drift describes as a matched deployment to support the protocol's relaunch and user recovery, and partners have committed up to $20 million. Neither has a set amount or timetable for the pool. As an upper bound, if both reached it in full, the pool would hold about 150.6 million, or roughly 50 cents per DFX. About $9.2 million remains frozen pending a law-enforcement order. Security firm Mandiant attributes the April theft to a North Korean cluster it tracks as UNC6862.
Bitget: on its own balance sheet
Bitget, the exchange that lost about $388 million in September, has frozen about $1.1 million, or about 0.3% of the total. Chief Executive Gracy Chen said in a television interview on Wednesday that she was "not expecting to recover a lot of funds." Blockchain analytics firm Chainalysis, which puts the theft at $387 million, said "DPRK-attributed threat actors" carried it out. Chen has called that attribution preliminary.
Bitget restored its user Protection Fund to $300 million from its own reserves after absorbing the loss, and reopened USDT withdrawals on Sept. 30. A final phase covering other tokens, fiat and peer-to-peer withdrawals was scheduled for Friday. Chen declined to name the third-party vendors involved in the breach.
Who pays
The three cases separate by who absorbs the loss. At NEAR Intents, the attacker returned the money. At Drift, users carry the loss unless outside commitments arrive. At Bitget, the exchange's own capital covered users.
The NEAR Intents attacker, whom the service said it had identified without naming publicly, returned the funds within a day. Mandiant attributes the Drift theft to a North Korean cluster, and Chainalysis attributes Bitget's to North Korea. In both of those cases, recovery from the attacker has so far been minimal.
Markers
Whether Tether's and partners' commitments reach Drift's pool, and when, will decide whether DFX stays near a penny or moves higher. Confirmation that Bitget's final withdrawal phase completed, and NEAR Intents' full postmortem, are the other markers.