Hassan Maishera
TL;DR
-
Attackers behind Bitget’s $388 million breach tried to route more than $50 million through NEAR Intents, according to the swap service.
-
Most attempted swaps were rejected; $503,000 was frozen during transactions, while about $166,000 passed through.
-
The $50 million figure represents attempted transfers, not funds recovered. The attackers reportedly took rejected funds to other providers.
-
NEAR Intents says its SHIELD system uses transaction monitoring and outside intelligence to flag suspicious activity.
What NEAR Intents says it stopped
Attackers linked to last week’s Bitget breach attempted to move more than $50 million through NEAR Intents, a service for swapping assets across blockchains.
NEAR Intents general manager Alex Shevchenko said its SHIELD system rejected most of those attempts, froze roughly $503,000 while transactions were underway, and allowed about $166,000 to pass through.
— Alex Shevchenko 🇺🇦 (@AlexAuroraDev) September 28, 2026
Those figures describe different outcomes. The more than $50 million was the estimated value of attempted swaps, not an amount seized or returned to Bitget.
Shevchenko said the tally excludes duplicate attempts and that funds rejected by NEAR Intents subsequently went to other providers. He cautioned that the estimates could vary from the actual amounts by roughly 10%.
Bitget disclosed the theft on September 24 after attackers bypassed controls protecting its exchange wallets.
The exchange has since published addresses associated with the attackers and offered bounties for eligible recovery efforts. Separately, stablecoin issuers Circle and Tether have frozen about $320,000 linked to the breach.
Shevchenko said SHIELD looks for unusual fund movements and draws on transaction monitoring providers, researchers, and other industry sources before deciding how to handle a swap.
NEAR Intents’ documentation also describes screening actual swap requests against risk data and delaying suspicious transactions.
Those checks apply to use of the swap service; they do not give its operators control over every wallet or transfer on the NEAR blockchain.
NEAR Intents plans to hold the $503,000 pending legal and recovery proceedings. Shevchenko asked Bitget to contact the service through legal and law enforcement channels and said NEAR Intents would waive its recovery bounty.
His report did not identify who can authorize release of the funds or describe a process for users whose transactions were wrongly flagged.
What “permissionless” means in practice
The decision has prompted scrutiny of NEAR Intents’ description of itself as permissionless, open and uncensorable. Critics argue that a service able to hold funds can also deny access to users it judges suspicious, creating questions about how those judgments are made and challenged.
NEAR cofounder Illia Polosukhin draws a distinction between the blockchain and businesses built on it. In his view, people can own and transfer assets or deploy contracts without permission, while an individual application or liquidity provider can still decline a transaction.
NEAR Intents’ critics dispute whether that distinction fits the service’s own marketing. THORChain has taken a different position, resisting Bitget’s request to block attacker addresses. An analysis identified about $6.3 million in completed ether-to-bitcoin swaps from one wallet linked to the attacker.
The two responses show that cross-chain services make different choices about intervention—and that NEAR Intent’s rejected swaps did not necessarily prevent the funds from moving elsewhere.
