NEAR Intents SHIELD System Blocks Over $50 Million in Bitget Hack Fund Transfers

This incident highlights the ongoing battle against cryptocurrency theft and the varying approaches to risk management in decentralized finance.

• NEAR Intents blocked over $50 million in attempted transfers linked to the Bitget exchange hack on September 24, 2026.
• Only $166,000 completed swaps while approximately $503,000 was frozen mid-execution, pending recovery processes.
• The intervention sparked debate on the meaning of "permissionless" in decentralized finance, contrasting NEAR's proactive stance with THORChain's non-intervention approach.

• Bitget suffered a significant breach, resulting in approximately $387.5–388 million stolen and transferred to attacker-controlled addresses across multiple blockchains.
• NEAR Intents operates as a cross-chain trading service, processing over $100 million in daily volume and employing the SHIELD system for risk detection.
• The incident raises questions about the responsibilities of decentralized protocols in managing known stolen funds while maintaining their permissionless nature.

The Bitget hack on September 24, 2026, resulted in a staggering theft of approximately $387.5–388 million, with attackers quickly attempting to launder the stolen assets through various cross-chain swap protocols. NEAR Intents, a protocol designed for facilitating asset exchanges across blockchains, utilized its SHIELD risk detection system to identify and block over $50 million in attempted transfers linked to this breach.

The SHIELD system operates by analyzing transaction patterns and leveraging inputs from Know Your Transaction (KYT) providers and intelligence sources. This proactive approach allowed NEAR Intents to flag suspicious activities and intervene before the majority of the transfers could be executed. While $166,000 managed to complete the swap, a significant $503,000 was frozen mid-execution, highlighting the effectiveness of the SHIELD system in mitigating potential laundering of stolen funds.

This incident has sparked a broader discussion within the decentralized finance community regarding the interpretation of "permissionless" access. NEAR's General Manager, Alex Shevchenko, emphasized that the protocol's design does not necessitate neutrality towards known stolen funds, asserting that permissionless access should not equate to facilitating illicit activities. This contrasts sharply with THORChain's approach, which opted not to intervene in similar situations, raising questions about the ethical responsibilities of decentralized platforms.

The response from Bitget's CEO, Gracy Chen, was notably positive, as she praised NEAR Intents for its intervention, framing it as a responsible example of how permissionless systems can operate without enabling criminal activities. This incident not only underscores the importance of robust risk management systems in the cryptocurrency space but also illustrates the varying philosophies among decentralized protocols regarding their role in preventing financial crime.

As the cryptocurrency landscape continues to evolve, the actions taken by NEAR Intents may set a precedent for how other protocols handle similar situations in the future. The balance between maintaining a permissionless environment and ensuring the integrity of transactions will be a critical area of focus for developers and users alike.

• Cryptocurrency traders: Increased scrutiny on transaction legitimacy may affect trading speed and liquidity.
• Decentralized finance platforms: Protocols may need to reassess their risk management strategies to align with user expectations.
• Regulatory bodies: Heightened awareness of security measures could lead to more stringent regulations in the crypto space.

• Future interventions by NEAR Intents: Monitoring how NEAR handles similar cases will provide insights into evolving risk management practices in decentralized finance.
• Responses from other protocols: Observing how platforms like THORChain react to this incident could indicate shifts in industry standards regarding intervention in suspected thefts.
• Regulatory developments: Keep an eye on potential regulatory responses as authorities may seek to establish clearer guidelines for managing stolen assets in the crypto ecosystem.