The recent $388 million exploit on the cryptocurrency exchange Bitget has thrust into sharp focus a critical and increasingly contentious issue within the digital asset space: the role of cross-chain swap services in handling illicit funds. While stolen cryptocurrencies often find their way through these services in an attempt to launder or move assets, the response from different platforms has revealed a stark ideological and operational divergence. In the wake of the Bitget incident, two prominent cross-chain swap services, NEAR Intents and THORChain, found themselves processing or refusing transactions linked to the same theft, showcasing vastly different philosophies on decentralization, security, and user protection.
NEAR Intents, a service that facilitates cross-chain exchanges by routing them through a network of independent solvers, reported blocking over $50 million in attempted transfers connected to the Bitget hack. This proactive stance, detailed in a report by general manager Alex Shevchenko, contrasts sharply with the actions of THORChain, the largest decentralized swap network. THORChain processed approximately $6.3 million in Ether-to-Bitcoin swaps originating from a wallet associated with the attack and, crucially, declined a request from Bitget to block the addresses involved in the illicit activity. This divergence in approach highlights a fundamental debate: should decentralized infrastructure prioritize absolute permissionlessness, or is there a place for built-in safeguards against criminal activity?
A Tale of Two Responses: Blocking vs. Permitting
The operational differences between NEAR Intents and THORChain are rooted in their underlying technological architectures and governing philosophies. NEAR Intents employs a system called SHIELD, which screens quote flows against multiple anti-money laundering (AML) data providers, including TRM Labs, AMLBot, PureFi, and Binance AML data, in addition to its own internal database. This multi-layered approach allowed SHIELD to intercept approximately $503,000 mid-transaction during the Bitget hack. An additional $166,000 was processed before detection systems fully engaged. The total figure of over $50 million represents refused transfer attempts, with duplicates removed and an estimated 10% error margin, quantifying the volume of illicit activity the service actively deterred.
Alex Shevchenko, in his report, contextualized this figure against NEAR’s regular operations, noting that the platform routinely handles over $100 million in daily volume. The amount refused represented a negligible fraction of this total, demonstrating that the implementation of SHIELD did not significantly impede legitimate user traffic or impact the service’s overall throughput. This suggests that robust screening mechanisms can be integrated into cross-chain infrastructure without sacrificing performance or user experience for legitimate participants.
In contrast, THORChain’s decision to process funds linked to the hack and refuse Bitget’s blocking request underscores its commitment to an uncompromising form of permissionless decentralization. The protocol’s stated position is that it "doesn’t censor by design." This ethos is deeply embedded in its architecture, which aims to operate as a truly decentralized and censorship-resistant network. THORChain has previously faced similar situations, including an incident in May where addresses associated with a $10.7 million exploit were not blacklisted. The protocol’s response to the Bitget hack echoed this stance, questioning the responsibility of base layer blockchains like Bitcoin, Ethereum, and BNB Chain when stolen funds move across them.
The "Permissionless" Debate: Boundaries and Implications
The contrasting responses from NEAR Intents and THORChain have ignited a fierce debate about the true meaning of "permissionless" in the cryptocurrency space. NEAR markets itself as a permissionless, open, and uncensorable platform. However, its ability to freeze funds mid-swap has led some, like Vini Barbosa, a technical writer at Ramp Labs, to question whether this constitutes a deviation from core permissionless principles. Barbosa argued on X that a truly permissionless system must be neutral, and a rail willing to restrict suspected illicit users might also inadvertently restrict individuals operating under repressive regimes.
NEAR’s co-founder, Illia Polosukhin, offered a more nuanced definition, stating that permissionless means no one needs permission to own, transfer assets, or deploy smart contracts. Shevchenko’s acknowledgment of a "gap between the two positions" and his framing of NEAR as "permissionless infrastructure, but with boundaries" suggests a pragmatic approach. This middle ground, which allows for risk mitigation without compromising fundamental decentralization, is increasingly appealing to institutional users who often prioritize security and regulatory compliance.
THORChain, by contrast, firmly adheres to the principle of absolute permissionlessness, even when faced with the prospect of facilitating illicit activities. The protocol’s official statement on X asserted that "A halt is not a selective freeze of specific funds or an individual swap. THORChain is permissionless and doesn’t censor by design." This rigid adherence to its design principles has drawn both praise from decentralization purists and criticism from those who believe that embracing a degree of control is necessary for the ecosystem’s long-term health and mainstream adoption.
The debate extends to the operational models of different blockchain networks. Critics of THORChain’s stance, including Bitget CEO Gracy Chen, argue that "decentralization is a design principle, not a shield for facilitating known stolen funds." Star Xu, founder of OKX, further challenged the comparison to Bitcoin, highlighting that THORChain’s validators collectively control assets in its vaults, making it an intermediary rather than a base layer protocol. He pointed to THORChain’s own 39-day halt in May due to vault security concerns as evidence of its capacity for intervention.
Beyond Swap Services: The Role of Stablecoin Issuers and Law Enforcement
The $388 million Bitget hack and the subsequent responses from cross-chain services are part of a larger ecosystem where different entities play distinct roles in asset security and recovery. While swap services grapple with the philosophical implications of censoring transactions, stablecoin issuers like Circle and Tether have demonstrated a more established and direct method of intervention. In the aftermath of the Bitget breach, these issuers collectively froze approximately $320,000 in USDC and USDT linked to the incident. While a small fraction of the total loss, this action serves as a potent reminder that issuer-level freezing remains one of the most reliable circuit breakers in crypto, operating on the asset itself rather than the application facilitating its movement.
The $503,000 frozen by NEAR Intents is currently being held pending a legal and recovery process. NEAR has waived any recovery bounty offered by Bitget and directs formal claims through a Kodex law-enforcement portal. However, the lack of publicly disclosed procedures for fund release and a clear process for wrongly flagged users to reclaim their assets raises significant questions. The SHIELD system, operating with a stated 10% error margin, means that legitimate transfers could be halted.
This situation mirrors a broader challenge in the burgeoning crypto industry: the absence of well-defined legal and operational frameworks for handling frozen assets. In traditional finance and securities markets, established processes exist to address such situations, largely to mitigate liability for holding funds without clear ownership or legal justification. The fact that NEAR’s screening layer has reached this point without a transparent and accessible remedy for users highlights the ongoing evolution of regulatory and operational standards in the decentralized finance space. The resolution of disputes surrounding these frozen funds will likely set a precedent for how such situations are managed in the future, testing whether transparency and due process can be integrated into crypto’s evolving security infrastructure.
Broader Implications for the Crypto Ecosystem
The incident surrounding the Bitget hack and the differing responses from NEAR Intents and THORChain have far-reaching implications for the cryptocurrency ecosystem. They highlight the inherent tension between the ideals of decentralization and the practical necessity of combating illicit financial activities.
Firstly, the case underscores that the perceived "structural inability" of cross-chain infrastructure to stop stolen funds is not an insurmountable technical limitation but rather a consequence of design choices. Services that take custody of assets, even briefly, during a swap have the opportunity to implement screening mechanisms. Whether they choose to do so becomes a business decision, influenced by their philosophical alignment and target market.
Secondly, the debate around "permissionless" infrastructure has intensified. While a commitment to censorship resistance is a cornerstone of blockchain technology, the reality of dealing with large-scale hacks forces a re-evaluation. The industry is grappling with how to balance absolute openness with the need for security and to prevent the space from becoming a haven for criminals. NEAR’s approach, attempting to carve out "boundaries" within a permissionless framework, may represent a more sustainable path for platforms seeking mainstream adoption, particularly from institutional investors who often require a degree of assurance against illicit fund flows.
Thirdly, the incident brings into sharp relief the fragmentation of approaches to security and regulation within the crypto space. While stablecoin issuers demonstrate a centralized authority capable of freezing assets, decentralized protocols like THORChain champion an unyielding adherence to their core design principles. This creates an uneven playing field and challenges for regulators attempting to establish comprehensive frameworks for the digital asset industry.
Finally, the unresolved status of the frozen funds by NEAR raises concerns about due process and the potential for error. As the crypto industry matures, it will need to develop robust and transparent mechanisms for asset recovery and dispute resolution, mirroring the established legal and financial frameworks of traditional markets. The success of this evolution will hinge on the ability of various stakeholders to collaborate and establish clear, enforceable standards that protect both legitimate users and the integrity of the broader ecosystem. The $503,000 currently held by NEAR represents not just stolen funds, but a critical test case for the future of accountability and recourse in decentralized finance.
