NEAR Intents Blocks $50M from Alleged Bitget Hackers

NEAR Intents says it has disrupted an attempted laundering flow connected to Bitget’s recent hack, blocking more than $50 million in transactions tied to the attacker’s cross-chain activity. The protocol also reports having frozen $503,000 during execution, with an additional $166,000 passing through amid the broader effort to identify and contain stolen funds.

The announcement comes as Bitget’s $387.5 million theft prompted renewed pressure on decentralized exchanges and cross-chain swap protocols to refuse service to exploit-related addresses. NEAR Intents’ stance highlights a recurring dilemma for permissionless infrastructure: how to preserve open interoperability while limiting the ability for criminals to monetize stolen assets.

Key takeaways

• NEAR Intents says SHIELD detected and blocked over $50 million in attempted transfers linked to the Bitget hack.
• The protocol reports $503,000 frozen during execution and $166,000 suspected stolen funds passing through.
• NEAR Intents says it will not take Bitget’s bounty for freezing or recovering attacker-linked funds, citing a legal return process.
• Circle and Tether reportedly blacklisted a wallet linked to the exploiter, freezing USDt and USDC amounts per on-chain data.
• Debate continues over whether decentralized swap systems like THORChain should selectively block exploit-related addresses.

NEAR Intents describes SHIELD blocking activity

According to NEAR Intents’ general manager Alex Shevchenko, a large portion of the funds stolen from Bitget earlier this week moved across blockchains, including transfers flowing toward Ethereum. Shevchenko framed the response around SHIELD, NEAR Intents’ detection and enforcement mechanism for cross-chain asset routing.

In a statement relayed by Shevchenko, the SHIELD system identified and prevented more than $50 million in attempted transfers associated with the attack. Shevchenko added that SHIELD also managed to freeze $503,000 during execution, while about $166,000 in funds suspected to be stolen was still able to pass through—suggesting that not every related movement can be halted in real time.

The protocol’s activity also illustrates how laundering attempts often rely on speed and routing across multiple networks, placing cross-chain systems at the center of modern incident response.

Why permissionless systems aren’t “neutral” in practice

Shevchenko argued that permissionless protocols do not have to be neutral in how they handle illicit behavior. “The people who build these systems make choices about what those protocols enable,” he said, adding that refusing to assist in laundering stolen assets is part of NEAR Intents’ design intent.

He connected that position to broader market structure, emphasizing that property rights are foundational to functional financial systems. In his view, an environment where theft automatically converts into unrestricted monetization undermines the credibility of digital asset markets and cannot be an “economic backbone” for the future.

NEAR Intents’ argument is likely to resonate with other players that have started to treat sanctions-like responses—blacklisting, freezing, and routing limitations—as an increasingly necessary layer for risk management, even in ecosystems that market themselves on openness.

Bitget bounty: NEAR Intents says it will forego rewards

NEAR Intents said it will not claim the bounty offered by Bitget. The protocol referenced a 5% reward for freezing attacker funds and an additional 5% for recovering them, saying it will instead allow more funds to be returned to Bitget.

Shevchenko stated that the frozen funds would be returned through what he described as an appropriate legal process. That detail matters for investors and users because it signals a more conventional pathway for asset handling—aligning technical containment with legal recovery rather than internal retention or discretionary allocation.

While the specific mechanics of that legal process were not detailed, the choice not to take the bounty could reduce incentives for rushed actions and reinforce coordination with affected counterparties.

Broader response: stablecoin issuers and THORChain debate

NEAR Intents’ disclosure arrives during a wider chain-reaction response to the Bitget hack. Earlier coverage and related on-chain observations indicated that Circle and Tether blacklisted a wallet linked to the Bitget exploiter, freezing $318,013 of USDt (USDT) and USDC based on on-chain data.

At the same time, Bitget CEO Gracy Chen publicly called on THORChain to refuse services to addresses connected to the attack. THORChain’s response emphasized that it “doesn’t censor by design,” and it noted that while it has halted its network in past scenarios, such actions are broad emergency security measures rather than selective freezes of specific funds or individual swaps.

This contrast underscores a key tension for decentralized cross-chain infrastructure: selective address blocking can look like censorship to some users, yet doing nothing may allow exploit-derived capital to move efficiently through permissionless liquidity. NEAR Intents’ SHIELD-based approach suggests an alternative framing—treating constraints not as censorship of users, but as built-in protections against helping criminals monetize stolen property.

In Shevchenko’s view, crypto cannot simultaneously demand recognition of digital property rights while building infrastructure optimized for turning stolen assets into spendable value.

What to watch next

Investors and builders may want to track whether SHIELD-style controls become more common across cross-chain systems, and—just as importantly—how regulators and courts view the intersection of permissionless routing with selective containment. The immediate question is how much additional stolen value can be identified, frozen, and returned as attackers keep moving funds across networks.