Near Intents blocks $50 million in Bitget hacker swaps, here's what happened

Near Intents blocks $50 million in Bitget hacker swaps, here’s what happened

The recent $388 million hack at the Bitget exchange sent ripples through the crypto ecosystem. In the wake of the breach, the cross‑chain swap platform Near Intents identified and halted more than $50 million of the stolen funds that attackers tried to move through its network. The incident has sparked a debate over the meaning of permissionless in the context of a protocol that can freeze assets.

How the swap service caught the stolen money

Near Intents operates a permissionless swap service that lets users exchange assets across blockchains without needing operator approval. Its internal SHIELD system, however, scans every transaction for links to known hacks, suspicious flow patterns, and intelligence from third‑party providers. When the Bitget attackers attempted to move stolen assets through the platform, SHIELD flagged the activity and froze $503,000 mid‑transfer. An additional $166,000 slipped through, while the rest of the attempted $50 million was blocked or redirected to other services.

The figures come from Near Intents’ general manager, Alex Shevchenko, who noted that duplicate attempts were removed from the tally and that the numbers could vary by up to 10 %. He emphasized that the service processes over $100 million of cross‑chain volume daily, so the amount intercepted in this case was a negligible fraction of its normal traffic.

Permissionless vs. “free‑ride” for bad actors

Near Intents’ ability to hold and freeze funds has drawn criticism from the community. Some users argue that a truly permissionless platform should not have the power to block or delay transactions. Others point out that permissionless simply means users can deploy contracts and transfer assets without gatekeepers; it does not obligate every application built on the chain to process every transaction.

The contrast is clear when compared to THORChain, which refused to block the Bitget attacker’s addresses and allowed $6 million of stolen ether to move to bitcoin. Near Intents’ approach—using SHIELD to detect and halt suspicious flows—illustrates a different philosophy: a permissionless infrastructure that still enforces boundaries to prevent illicit activity.

What happens to the frozen funds?

Shevchenko said Near Intents will keep the intercepted funds on hold pending a legal and recovery process. The protocol has not yet clarified who can authorize the release of the money or how users mistakenly flagged as suspicious can recover their assets. He did, however, invite Bitget to engage through legal and law‑enforcement channels and offered to waive its recovery bounty.

The incident underscores the importance of robust post‑breach protocols. While Near Intents’ SHIELD system prevented a large portion of the stolen money from moving through its network, the lack of a clear recovery path for affected users highlights a gap that could erode trust in permissionless services.

Takeaway for the broader ecosystem

• Cross‑chain swaps can act as a first line of defense against the movement of stolen funds, provided they incorporate real‑time monitoring and intelligence feeds.
• Permissionless does not mean unregulated; protocols can remain open while still enforcing safeguards against illicit activity.
• Clear recovery procedures are essential for maintaining user confidence, especially when a platform can freeze assets.

Near Intents’ intervention shows that even permissionless services can play a crucial role in mitigating the fallout from major hacks, but it also highlights the need for transparent policies around asset holds and recoveries.

---

TL;DR: Near Intents blocked over $50 million of stolen Bitget funds using its SHIELD system, sparking debate over the limits of a permissionless swap service and the need for clear recovery procedures.