The cryptocurrency world was once again rocked by a significant security breach last week, with approximately $388 million being drained from the Bitget exchange. This incident has thrust into sharp focus a critical debate within the industry: the role of cross-chain swap services in managing illicit funds and the fundamental tension between decentralization and the ability to control or reclaim stolen assets. While some services are actively screening and blocking transactions linked to the theft, others maintain a staunch commitment to their permissionless ethos, leading to divergent responses and raising profound questions about the future of crypto security and regulation.
The Bitget Breach and the Flow of Stolen Funds
The massive withdrawal from Bitget, totaling $388 million, immediately triggered concerns about the movement of these illicit funds. Cryptocurrency, with its inherent pseudonymous nature and global reach, often presents challenges for law enforcement and exchanges seeking to recover stolen assets. A primary conduit for such movement is often found in cross-chain swap services, which facilitate the transfer of digital assets between different blockchain networks.
In the wake of the Bitget hack, two prominent cross-chain swap services, NEAR Intents and THORChain, found themselves at the center of this activity, exhibiting starkly different approaches. NEAR Intents, a service that routes exchanges between blockchains through a network of solvers, reported blocking over $50 million in attempted transfers directly linked to the Bitget theft. This figure, detailed in a report by its general manager Alex Shevchenko, represents a significant intervention in the flow of stolen funds.
Conversely, THORChain, described as the largest decentralized swap network, processed approximately $6.3 million in ether-to-bitcoin swaps originating from a wallet associated with the attack. More critically, THORChain publicly declined Bitget’s request to block the addresses involved in these transactions, asserting its commitment to a permissionless and uncensorable design. This contrast highlights a fundamental schism: one network actively screens its transaction flow to intercept illicit funds, while the other adamantly refuses to do so, prioritizing its core principles.
NEAR Intents: Proactive Screening and the SHIELD System
NEAR Intents’ intervention is attributed to its sophisticated screening system, dubbed SHIELD. This system actively monitors transaction quotes against a suite of established anti-money laundering (AML) data providers, including TRM Labs, AMLBot, and PureFi, in addition to an internal AML database. According to Shevchenko’s report, SHIELD managed to freeze roughly $503,000 in mid-transaction. Another $166,000 was processed before detection mechanisms caught up. The reported $50 million figure represents the total volume of attempted transfers that were refused, with duplicates removed and an acknowledged error margin of approximately 10%. This represents the volume the service actively turned away, rather than funds it currently holds.
The real-world test of SHIELD’s efficacy came with the live attacker funds from the Bitget breach. This scenario is far more impactful than any simulated test that compliance vendors can typically offer. Shevchenko framed the blocked amount within the context of NEAR Intents’ daily operations, noting that the service routinely processes over $100 million in daily volume. The refusals, therefore, constituted a negligible fraction of its overall activity and did not impede its normal business flow.
The ability of NEAR Intents to screen and block these transactions challenges a long-held assumption within the crypto space: that cross-chain infrastructure is inherently incapable of preventing the movement of stolen funds due to the absence of a central authority to freeze accounts. The Bitget incident suggests that this constraint is not a technical limitation but rather a business decision. Services that take temporary custody of assets during a swap process have the opportunity to screen them. Whether they choose to do so becomes a matter of operational policy and risk management.
THORChain: The Uncompromising Stance on Permissionless Swaps
THORChain’s decision to process the stolen funds and decline Bitget’s request for a block has ignited a firestorm of debate. The protocol’s public statements on X (formerly Twitter) underscored its foundational principles: "THORChain is permissionless and doesn’t censor by design." The network drew parallels to the immutability of base layers like Bitcoin and Ethereum, questioning the responsibility of these networks when stolen funds move across them. They also pointed out that addresses involved in a previous $10.7 million hack of THORChain’s own vaults in May were never blacklisted, nor were addresses associated with the staggering $1.5 billion Bybit theft last year.
This unwavering commitment to a permissionless model positions THORChain as a network that prioritizes user autonomy and censorship resistance above all else. However, it also means that it cannot, by design, act as a gatekeeper for illicit funds. The argument is that any mechanism for selective freezing, even for criminal proceeds, could eventually be used to censor legitimate transactions, particularly for individuals operating under oppressive regimes.
The Permissionless Debate: Boundaries and Implications
The contrasting approaches of NEAR Intents and THORChain encapsulate a central dilemma in the evolution of blockchain technology. NEAR Intents, by implementing the SHIELD system, appears to be carving out a niche that balances its "permissionless infrastructure" with "boundaries." This approach acknowledges the growing demand from institutional users for more secure and regulated rails.
Vini Barbosa, a technical writer at Ramp Labs, voiced a concern shared by many in the decentralization community. He argued on X that the term "permissionless" must inherently mean neutral. A system willing to restrict access for suspected unlawful users could, in theory, also restrict access for those engaging in legitimate financial activities under duress or in jurisdictions with strict capital controls.
NEAR Intents co-founder Illia Polosukhin offered a more nuanced definition, stating that permissionless means no one needs permission to own, transfer, or deploy smart contracts. Shevchenko’s acknowledgment of "boundaries" suggests a pragmatic approach, one that may be necessary for broader adoption and integration with traditional finance.
The implications of this divide are significant. On one hand, the ability to screen and block illicit funds, as demonstrated by NEAR Intents, could provide a crucial layer of security and compliance, potentially reducing the attractiveness of crypto for criminals. It offers a semblance of recourse for victims of hacks and scams.
On the other hand, THORChain’s staunch adherence to its decentralized ethos raises important questions about the very nature of censorship resistance in the blockchain space. While champions of pure decentralization may support THORChain’s decision, key figures from the broader industry have pushed back. Bitget CEO Gracy Chen criticized the notion of decentralization being used as a "shield for facilitating known stolen funds." Similarly, OKX founder Star Xu challenged the comparison to Bitcoin, arguing that THORChain, with its validators jointly controlling assets, functions as an intermediary, not a base layer, and has previously halted operations for its own protection.
The Role of Stablecoin Issuers: A Different Circuit Breaker
While the debate rages between different layers of the crypto infrastructure, stablecoin issuers like Circle and Tether continue to demonstrate their power as a more traditional circuit breaker. In the aftermath of the Bitget breach, both companies froze approximately $320,000 in USDC and USDT linked to the hack. While this amount is a rounding error compared to the total loss, it serves as a potent reminder that issuer-level freezing remains one of the most reliable methods for halting illicit crypto flows. This is because these actions operate directly on the asset itself, rather than on the application or protocol.
The Unclaimed $503,000: A Test Case for Due Process
NEAR Intents is currently holding the $503,000 that SHIELD intercepted. The funds are pending a legal and recovery process, and NEAR Intents has waived any recovery bounty that Bitget may have offered. Formal claims are to be routed through a dedicated law-enforcement portal managed by Kodex. However, the lack of clarity regarding who can authorize the release of these funds and the absence of a published process for individuals who believe their assets have been wrongly flagged present a significant challenge.
The SHIELD system, operating with an acknowledged 10% error margin, means that legitimate transactions could potentially be halted. In traditional financial and securities industries, holding funds without a clearly defined process for release and recourse creates significant legal liability. The current situation with NEAR Intents and the frozen $503,000 highlights that the burgeoning screening layer in crypto has arrived at a similar point of potential liability without the established procedural safeguards.
The upcoming resolution of the dispute over these funds will serve as a critical test. The question remains whether the release of these funds will follow a transparent, rule-based procedure that is accessible to all parties, or if it will set a precedent for a more opaque and potentially arbitrary system of asset control within the decentralized finance ecosystem. The Bitget hack has not only exposed the vulnerabilities in crypto security but has also illuminated the complex and often conflicting philosophies governing its development and operation.
