The cryptocurrency world is grappling with a fundamental conflict between security and decentralization following a massive $388 million hack that targeted Bitget last week. The sheer scale of the theft has illuminated a critical divergence in how different cross-chain swap services handle illicit funds, pitting those that implement screening mechanisms against those that champion absolute permissionless access. At the heart of this debate lies the question of whether the nascent infrastructure of decentralized finance is evolving to become a tool for illicit actors or a robust ecosystem capable of self-regulation.
The stolen cryptocurrency, swiftly moved from Bitget, primarily sought refuge in the complex pathways of cross-chain swap services. These platforms, designed to facilitate the seamless transfer of assets between different blockchain networks, have become a favored conduit for launderers seeking to obscure the origin of stolen funds. In the wake of the Bitget incident, two prominent cross-chain swap services, NEAR Intents and THORChain, offered starkly contrasting responses, revealing a deep ideological and technical chasm within the decentralized finance (DeFi) landscape.
NEAR Intents, a service that routes exchanges between blockchains via a network of decentralized solvers, reported blocking over $50 million in attempted transfers directly linked to the Bitget theft. This figure, detailed in a report by NEAR Intents’ general manager Alex Shevchenko, represents a significant proactive measure against the flow of stolen assets. In contrast, THORChain, arguably the largest decentralized swap network, processed approximately $6.3 million in ether-to-bitcoin swaps originating from a wallet tied to the attack. Furthermore, THORChain explicitly declined Bitget’s request to freeze or block the addresses involved in these transactions, reinforcing its commitment to a strictly permissionless model. This dichotomy – one network actively screening its flows, the other adamantly refusing to do so – has ignited a heated debate about the future of security and censorship resistance in the cryptocurrency space.
A Marketing Claim Meets Live Attacker Money
The effectiveness of NEAR Intents’ security measures, marketed under the SHIELD system, was put to the ultimate test by the real-world threat of the Bitget hack. According to Shevchenko’s report, the SHIELD system managed to freeze approximately $503,000 mid-transaction. An additional $166,000 passed through before the detection mechanisms could fully intervene. The reported figure of over $50 million represents the total volume of attempted transfers linked to the theft that NEAR Intents refused. This calculation accounts for duplicate entries and carries an estimated error margin of about 10%, reflecting the inherent complexities of tracking and categorizing such large volumes of illicit activity in real-time. Crucially, this figure denotes the volume of transactions turned away by the service, rather than assets currently held in its custody.
The SHIELD system’s operational framework relies on screening transaction quote flows against data provided by several reputable blockchain analytics firms and anti-money laundering (AML) service providers. These include TRM Labs, AMLBot, PureFi, and internal AML databases, as well as data from major exchanges like Binance. This multi-layered approach aims to identify and flag suspicious activities before they are finalized. The critical differentiator in this instance was that the compliance checks were not conducted on simulated data but on live, illicit funds actively being moved by attackers. Such a scenario provides an unparalleled and stark validation for any security protocol, as it mirrors the real-world challenges that compliance vendors typically cannot replicate in controlled pilot programs.
Alex Shevchenko contextualized the significant sum of blocked funds by comparing it to NEAR Intents’ ordinary business operations. He highlighted that NEAR Intents routinely processes over $100 million in daily trading volume. From this perspective, the refused transfers constituted a relatively negligible fraction of their overall activity. This suggests that the implemented screening mechanisms, while robust enough to intercept substantial illicit flows, did not materially impede the platform’s regular, legitimate business or deter its user base. This balance between security and operational efficiency is a key consideration for any DeFi protocol aiming for mainstream adoption.
The broader implication of NEAR Intents’ actions is that the long-held assumption of cross-chain infrastructure being inherently incapable of preventing the movement of stolen funds may be more of a deliberate choice than a technical limitation. Historically, the decentralized nature of these networks, coupled with the absence of a central authority or identifiable accounts to freeze, has made them appear as an insurmountable barrier for law enforcement and security teams. However, the Bitget case demonstrates that services which take temporary custody of assets during a swap, even for a brief period, possess a critical window of opportunity to perform security screenings. The decision to implement such screenings, therefore, appears to be a business and ethical decision rather than an insurmountable technical hurdle.
Permissionless, With Boundaries
NEAR Intents’ approach to security has sparked a debate about its branding as a "permissionless" service. The platform markets itself as open, uncensorable, and requiring no prior authorization for users to interact with its protocols. However, the ability to freeze funds mid-swap inherently introduces an element of permissioned control, a concept that many in the decentralized ethos find contradictory. Vini Barbosa, a technical writer at Ramp Labs, articulated this concern on the social media platform X, arguing that true "permissionless" means being neutral. He posited that a system willing to restrict suspected unlawful users could, in theory, also be compelled to restrict individuals moving funds under repressive regimes, thereby compromising its core principles of censorship resistance.
In response to these concerns, NEAR Intents co-founder Illia Polosukhin clarified the platform’s definition of permissionless. He stated that it primarily means that no external authority is required for individuals to own, transfer, or deploy smart contracts. Shevchenko’s nuanced phrasing, "permissionless infrastructure, but with boundaries," acknowledges the perceived gap between these two interpretations. This suggests a strategic evolution for NEAR Intents, aiming to balance the ideals of decentralization with the practical necessities of security and compliance, particularly as the platform seeks to attract institutional users who often prioritize robust security and regulatory compliance.
THORChain, on the other hand, has taken a firm stance on the side of absolute permissionless access. The protocol explicitly stated its position in a public announcement on X: "A halt is not a selective freeze of specific funds or an individual swap. THORChain is permissionless and doesn’t censor by design." The protocol further challenged the comparison to base-layer blockchains like Bitcoin, Ethereum, and BNB Chain, questioning their responsibility when stolen funds traverse their networks. THORChain pointed out that addresses involved in a $10.7 million theft from its own vaults in May were never blacklisted, and a similar situation arose following the $1.5 billion Bybit theft last year. This implies a consistent philosophy of non-intervention, regardless of the origin of the funds.
The decision by THORChain to reject Bitget’s request has garnered support from staunch decentralization advocates. However, it has also drawn significant criticism from key figures within the broader crypto industry. Bitget CEO Gracy Chen, whose request was denied, publicly stated on X that decentralization is "a design principle, not a shield for facilitating known stolen funds." Similarly, OKX founder Star Xu contested THORChain’s comparison to Bitcoin, arguing that THORChain’s validators jointly control assets in its vaults, positioning it as an intermediary rather than a base layer protocol. He cited the 39-day halt of THORChain in May, when its own vaults were at risk, as evidence of its capacity for centralized decision-making when its interests are threatened.
The Third Layer: Stablecoin Issuers as Circuit Breakers
Beyond the cross-chain swap services, stablecoin issuers represent a crucial layer in the crypto ecosystem’s response to illicit fund flows. Both Circle, the issuer of USDC, and Tether, the issuer of USDT, moved swiftly to freeze approximately $320,000 in their respective stablecoins that were linked to the Bitget breach. While this amount is a fraction of the total loss, it serves as a potent reminder of the effectiveness of issuer-level freezing. This mechanism operates directly on the asset itself, providing a more direct and often more reliable circuit breaker than application-level interventions. The ability of entities like Circle and Tether to blacklist specific addresses and thus render those stablecoins unusable on most platforms provides a powerful, albeit centralized, tool for combating theft.
The Frozen $503,000 Has No Owner of Record
NEAR Intents is currently holding the $503,000 in intercepted funds, awaiting a formal legal and recovery process. The platform has explicitly waived any recovery bounty that Bitget may have offered, indicating a commitment to facilitating a legitimate resolution. Formal requests for the funds are to be routed through a dedicated law-enforcement portal operated by Kodex Global. This channel is intended for Bitget or other authorized investigators to formally claim the seized assets. However, Shevchenko’s report notably does not specify who has the ultimate authority to authorize the release of these funds, nor does it outline a clear process for users who may have been erroneously flagged and had their legitimate transactions blocked. This ambiguity is particularly concerning given that the screening system itself operates on estimates with a stated error margin of 10%.
The situation with the frozen $503,000 highlights a critical challenge facing the nascent crypto screening layer. A system that can halt a legitimate transfer, without a transparent and accessible release authority or a clear remedy for wrongly flagged users, effectively holds individuals’ money on suspicion. Traditional financial and securities industries have long established detailed processes for handling such disputes, as holding funds without due process typically carries significant legal liabilities across most jurisdictions. The current state of crypto screening, as exemplified by this incident, appears to have reached a similar juncture in terms of operational challenges but without the corresponding mature procedural frameworks.
The ultimate resolution of the dispute over the $503,000 held by NEAR Intents will serve as a critical test case. The outcome will reveal whether the release of these funds will adhere to a publicly discernible rule set, thereby establishing a precedent for how such situations are handled in the future. The industry is watching closely to see if this incident will push the development of more standardized and transparent processes for asset recovery and dispute resolution within decentralized financial systems, or if it will underscore the inherent risks and ambiguities that persist in this rapidly evolving technological landscape. The tension between absolute decentralization and the practical needs for security and accountability in the face of large-scale financial crime remains a central and unresolved narrative in the ongoing evolution of cryptocurrency.
