A cross-chain protocol just refused to help launder 50 million USD worth of stolen Bitget funds — and reignited the biggest fight in DeFi: should “code is law” platforms ever say no? NEAR Intents revealed on September 29 that its SHIELD screening system blocked more than 50 million USD in transfers linked to the 387.5 million USD Bitget hack, one of the largest exchange thefts of 2026.
By David Chen | September 29, 2026
The Hook: A DeFi Bouncer at the Door
NEAR Intents is a protocol that lets people swap assets between blockchains — Bitcoin for Ethereum, Tron tokens for something else — through a network of middlemen called solvers. Think of it as a currency exchange booth that works across different blockchains. On September 29, Alex Shevchenko, general manager of NEAR Intents, said publicly that the protocol’s SHIELD system — its built-in screening layer for detecting illicit activity — identified flows tied to the Bitget attacker’s wallets and stopped them from completing through its infrastructure.
The numbers, according to Shevchenko’s disclosure reported by crypto.news: SHIELD rejected more than 50 million USD in Bitget-linked transfer attempts across chains. During execution it froze about 503,000 USD, while roughly 166,000 USD in suspected stolen funds slipped through before being stopped. The rejected transfers simply moved on toward other service providers — the ugly reality of chasing thieves across an open financial system.
On-Chain Evidence: Following the Dirty Money
The backdrop is the September 24 breach of Bitget, which confirmed that roughly 387.5 million USD reached attacker-controlled addresses — an upward revision from its first estimate of 351.6 million USD after investigators traced additional Zcash and Tron assets. Blockchain compliance firm AMLBot tracked one laundering route in detail: funds originating on Tron moved through USDT0 to Ethereum, were converted into roughly 145 ETH, passed through THORChain, and emerged as approximately 4.59 BTC — some of which later entered a Wasabi CoinJoin mixing transaction, an old trick for obscuring Bitcoin’s transaction history.
NEAR Intents is also passing on the reward. Bitget’s recovery bounty program pays 5 percent of any assets a participant helps freeze, and another 5 percent for funds successfully recovered. Shevchenko said the protocol will waive its bounty and return the frozen 503,000 USD through legal processes instead — leaving more on the table for the exchange itself.
The Core Conflict: Two Philosophies of DeFi Collide
The really important part is what Shevchenko said next — and what THORChain said in reply. “A financial system where stealing an asset gives you an unrestricted right to monetize it isn’t a freer system,” Shevchenko argued. “It is simply a system that protects the thief.” His point: builders of permissionless systems still make choices about what their infrastructure permits, and “refusing to help launder stolen assets” is one of those choices.
THORChain, the cross-chain swapping giant that Bitget CEO Gracy Chen publicly urged to block attacker addresses, disagreed. The protocol stated it does not selectively censor individual transactions by design. It can halt the network in emergencies, it acknowledged — but those controls protect protocol security broadly, and an emergency halt “is not a selective freeze of specific funds or an individual swap.” Security firm GoPlus pushed back, pointing to THORChain’s validator-controlled vaults, its Mimir governance controls, and its ability to halt chain signing as evidence that the “we can’t intervene” stance is more choice than necessity. Centralized stablecoin issuers took a third path: Circle and Tether blacklisted an Ethereum address linked to the exploiter, no debate required.
Market Implications: Why This Matters for Your Wallet
If you hold crypto on exchanges or use DeFi protocols, this fight is about who protects you when things go wrong:
- Recovery odds improve with screening. Every protocol that adopts SHIELD-style checks makes the “cash-out” phase of a hack harder — which, over time, could deter theft itself.
- Decentralization is under the microscope. If validators can halt networks but claim they cannot freeze a thief, regulators will keep asking uncomfortable questions — and answers like THORChain’s may accelerate rules that affect every DeFi user.
- The bounty economy is real. Bitget’s 5-plus-5 percent program turns exchanges, security firms, and on-chain investigators into a distributed recovery network. Expect that template to spread after future hacks.
For the DeFi sector’s reputation with institutions, a protocol voluntarily rejecting 50 million USD in flow — and giving up its bounty — is the kind of credibility money cannot buy. It signals that “permissionless” does not have to mean “anything goes.”
The Verdict: Principles Are Being Tested in Real Time
The NEAR Intents disclosure does not settle the censorship debate — it sharpens it. One protocol decided that property rights, not unrestricted movement of stolen funds, is the foundation of a functioning market. Another insists that selective intervention is a line it will not cross, emergency halts notwithstanding. Both just showed users exactly where they stand. For everyday investors, the takeaway is practical: the infrastructure you choose to route money through now has a visible policy on stolen funds, and after a 387.5 million USD hack, that policy is no longer an abstraction. DeFi is growing up in public, one hard decision at a time.
The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.
Blocking 50 million of the Bitget haul and refusing the bounty on top. That is a protocol choosing reputation over a payday, rare in this industry.
they still let 166k slip through before the wallets got flagged. good outcome overall but SHIELD caught this mid stream, not at the door
166k slipping through against 50M+ blocked and ur calling that a miss lol. thats a 99.7% catch rate
Reputation is the payoff here. NEAR Intents just became the screened route of record while the laundering lanes get blacklisted everywhere else.
Respect the bounty waiver but 503k frozen out of a 387.5 million haul is a rounding error. The reputation value alone is worth more than 5 percent of that anyway
AnnaReid_ said it. blocking 50M of the 387.5M Bitget haul is one thing, waving the bounty on top is what surprises me. most teams would have quietly pocketed that and posted a thread about transparency
blocking the 50M is fine until the screener decides your withdrawal looks dirty one day. everyone cheering SHIELD hasnt thought two steps ahead
the flagged addresses were literally tied to the 387.5M Bitget theft, not random withdrawals. screening hack-linked wallets is not the same as freezing your coffee money
The 387.5 million Bitget theft was huge so one blocked lane was never going to stop it. Still, every frozen route raises the cost of cashing out.
the AMLBot route had them washing through THORChain into 4.59 BTC and a Wasabi mix anyway. blockers mostly just move the problem next door
the 4.59 BTC Wasabi route is a rounding error of the 387.5M haul, you’re right. still think the win is precedent. one solver publicly eating the bounty loss makes it way easier for the next one to say no
true, but the stolen funds just moved on to other service providers. screening only works if the whole solver space adopts it