The recent breach of cryptocurrency exchange Bitget, resulting in the loss of an estimated $388 million, has thrust into sharp relief a critical debate within the blockchain ecosystem: how to handle stolen funds in a decentralized world. At the heart of this controversy lies the role of cross-chain swap services, the primary conduits through which illicitly acquired digital assets are typically laundered. In the wake of the Bitget hack, two prominent cross-chain swap protocols, NEAR Intents and THORChain, have responded to the challenge with markedly different strategies, highlighting a growing tension between decentralized principles and the practical demands of security and compliance.
The $388 million drained from Bitget last week represents one of the largest hacks in recent cryptocurrency history. The sheer volume of funds immediately triggered efforts to trace and, if possible, intercept the stolen assets. Cross-chain swap services, designed to facilitate the seamless transfer of cryptocurrencies between different blockchain networks, have become the go-to infrastructure for malicious actors seeking to obscure the origin of their ill-gotten gains. These services, by their nature, often involve brief periods of custody over the transferred assets, creating a potential window for intervention.
NEAR Intents: Proactive Interception and a "Permissioned Infrastructure with Boundaries"
NEAR Intents, a swap service that operates by routing exchanges between blockchains through a network of decentralized solvers, demonstrated a proactive approach to mitigating the impact of the Bitget theft. According to a report by Alex Shevchenko, the general manager of NEAR Intents, the service successfully blocked over $50 million in attempted transfers linked to the Bitget hack within the same week. This figure, while subject to an estimated 10% margin of error and accounting for deduplicated transfer attempts, represents a significant intervention in the flow of stolen funds.
The mechanism behind NEAR Intents’ success is a system called SHIELD. This system screens transaction "quote flows" against a suite of established anti-money laundering (AML) data providers, including TRM Labs, AMLBot, PureFi, and Binance AML data, in addition to an internal AML database. SHIELD reportedly froze approximately $503,000 mid-transaction. While a portion of funds, roughly $166,000, managed to pass through before detection mechanisms fully engaged, the overall impact of the SHIELD system was substantial.
Shevchenko contextualized the blocked amount by noting NEAR Intents’ typical daily volume, which often exceeds $100 million. The refusals, therefore, constituted a relatively small fraction of their normal operations, indicating that the screening process did not significantly disrupt legitimate user activity or the service’s overall flow. This real-world test, involving live attacker funds, provided a crucial validation for NEAR Intents’ compliance framework, a level of practical testing that theoretical pilots cannot replicate.
The ability of NEAR Intents to intercept funds raises fundamental questions about the immutability and censorship-resistance of blockchain technology. While NEAR markets itself as a "permissionless, open, and uncensorable" ecosystem, the action taken by SHIELD could be construed as a form of permissioned activity. Vini Barbosa, a technical writer at Ramp Labs, articulated this concern on X, arguing that true permissionlessness necessitates neutrality. He cautioned that a platform willing to restrict suspected unlawful users could, in theory, also restrict individuals operating under oppressive regimes, thereby undermining the core tenets of decentralization.
In response to these concerns, NEAR’s co-founder, Illia Polosukhin, clarified that "permissionless" in their context refers to the freedom for individuals to own, transfer assets, and deploy contracts without requiring explicit authorization. Shevchenko, however, acknowledged the nuance, describing the service as "permissionless infrastructure, but with boundaries." This framing suggests a strategic evolution, where the desire to attract institutional users, who typically prefer regulated and screened environments, has led to the incorporation of compliance measures, even if it introduces a degree of intermediation.
THORChain: The Uncompromising Stance on Decentralization
In stark contrast to NEAR Intents’ proactive blocking, THORChain, the largest decentralized swap network, adopted a diametrically opposed stance. The protocol processed approximately $6.3 million in ether-to-bitcoin swaps originating from a wallet directly tied to the Bitget attack. Furthermore, THORChain explicitly declined Bitget’s request to block the addresses involved in the illicit transactions.
THORChain’s position is rooted in its unwavering commitment to being "permissionless and doesn’t censor by design." In a statement on X, the protocol articulated its philosophy by posing a rhetorical question: what responsibility do base-layer blockchains like Bitcoin, Ethereum, and BNB Chain bear when stolen funds move across them? They pointed out that addresses involved in previous large-scale thefts, including a $10.7 million incident from THORChain’s own vaults in May and the $1.5 billion Bybit theft last year, were never blacklisted. For THORChain, the principle of non-censorship extends to its own operations, meaning it will not proactively block or freeze transactions based on external requests, even from entities like Bitget.
This decision has ignited a vigorous debate within the broader cryptocurrency industry. While proponents of extreme decentralization laud THORChain’s adherence to its core principles, many industry leaders have voiced strong opposition. Gracy Chen, CEO of Bitget, publicly criticized THORChain’s stance, asserting on X that "decentralization is a design principle, not a shield for facilitating known stolen funds." This sentiment underscores the growing pressure on decentralized protocols to reconcile their architectural ideals with the practical realities of combating financial crime.
Star Xu, founder of OKX, further challenged THORChain’s comparison to base-layer blockchains. He argued that THORChain’s validators collectively control the assets in its vaults, positioning the network as an intermediary rather than a foundational layer. This distinction, Xu suggested, makes THORChain more akin to traditional financial institutions that have a responsibility to implement controls. He also referenced an incident in May where THORChain’s own validators halted the network for 39 days to protect its vaults, implying a precedent for intervention when the protocol’s own assets were at stake.
The Broader Implications: A Crossroads for Crypto Infrastructure
The divergent responses from NEAR Intents and THORChain highlight a fundamental schism in how the cryptocurrency industry is grappling with the challenge of stolen assets. The $388 million Bitget hack, and the subsequent differing reactions of these cross-chain services, serve as a critical inflection point.
For years, cross-chain infrastructure has been widely regarded as a structurally difficult area to police for illicit activities. The distributed nature of these networks, the lack of a central authority, and the inherent anonymity often associated with blockchain transactions have made it seem almost impossible to freeze or recover stolen funds once they enter these pathways. However, the actions of NEAR Intents demonstrate that this constraint is not necessarily a technical impossibility but rather a business and philosophical choice. Services that maintain even temporary custody of assets during a swap have the technical capability to implement screening mechanisms. The decision of whether or not to do so becomes a defining characteristic of their service offering and their adherence to decentralized ethos.
The intervention by stablecoin issuers Circle and Tether, who froze approximately $320,000 in USDC and USDT linked to the Bitget breach, offers a contrasting perspective on asset recovery. While this amount is a small fraction of the total loss, it serves as a potent reminder that issuer-level freezing remains one of the most effective circuit breakers in the crypto space. This method operates directly on the asset itself, irrespective of the application or network through which it is being moved, unlike application-level interventions like those employed by NEAR Intents.
The Frozen Funds and the Unanswered Questions
NEAR Intents is currently holding the intercepted $503,000, pending legal and recovery processes. The service has also waived any recovery bounty that Bitget may have offered. Formal requests for the funds are routed through a dedicated law-enforcement portal managed by Kodex, serving as the official channel for Bitget or investigative bodies to claim the assets.
However, the report from Shevchenko does not specify who has the authority to authorize the release of these frozen funds, nor does it outline a clear process for users who might be wrongly flagged. Given that the SHIELD screening system operates on estimates with a stated error margin of 10%, the possibility of legitimate transfers being halted and subsequently frozen cannot be dismissed.
This situation places NEAR Intents in a precarious position. A system that halts a legitimate transfer, with no transparent release authority and no readily available remedy for the affected user, essentially becomes a de facto custodian of someone’s money based on suspicion. The traditional securities and payments industries have long established protocols for handling such situations, recognizing the significant legal liabilities associated with holding funds without due process. The nascent screening layer within the cryptocurrency space appears to be reaching a similar juncture, but without the established procedural frameworks.
The ultimate resolution of the frozen $503,000 will likely serve as a critical test case. The manner in which these funds are released, or not released, will set a precedent for how decentralized infrastructure providers navigate the complex interplay between security, compliance, and the core principles of decentralization. It will determine whether these emerging "boundaries" are clearly defined and accessible to all, or if they represent an opaque mechanism that could inadvertently ensnare legitimate users, thereby undermining the very trust that underpins the cryptocurrency ecosystem. The Bitget hack has not only exposed a vulnerability in exchange security but has also illuminated a profound philosophical and operational divide within the decentralized finance landscape, a divide that will undoubtedly shape its future trajectory.
