NEAR Intents says it intercepted about $503,000 connected to the $388 million Bitget hack, after attackers attempted to move more than $50 million through the cross-chain swap service. Around $166,000 nevertheless completed swaps through the platform, while other rejected funds later moved through different providers.
According to CoinDesk, the intervention has intensified a debate over what “permissionless” means for blockchain applications. NEAR Intents presents itself as open and uncensorable infrastructure, but its SHIELD monitoring system can identify suspicious swap requests, delay transactions and hold funds linked to reported hacks.
How NEAR Intents handled the attempted transfers
The figures published by NEAR Intents general manager Alex Shevchenko refer to attempted transfers rather than the amount ultimately recovered. The service said it identified more than $50 million in attempted activity associated with the Bitget attacker and stopped approximately $503,000 while those transactions were in progress. About $166,000 passed through NEAR Intents.
Shevchenko said duplicate attempts were removed from the calculation and that funds rejected by the service subsequently moved through other providers. He also described the figures as estimates that could differ from the actual amounts by roughly 10%.
The intercepted funds are being held while legal and recovery proceedings take place. NEAR Intents asked Bitget to contact it through legal and law-enforcement channels and said it would waive its recovery bounty. However, the report did not specify who has authority to release the funds or what process would be available to users whose assets were incorrectly flagged.
SHIELD is central to the service’s response. According to Shevchenko, it assesses transaction flows using information from know-your-transaction providers, intelligence companies, independent researchers and major centralized crypto platforms. The system can then determine how a swap should be handled when its signals indicate unusual or potentially illicit activity.
The checks apply when users submit transactions through NEAR Intents. They do not give the service control over every wallet or transaction on the wider NEAR blockchain.
Why the intervention has prompted a debate
The episode has exposed a disagreement over the meaning of permissionless infrastructure. In crypto, the term generally refers to systems that allow users to access a network, hold and transfer assets, or deploy contracts without seeking approval from a central operator. Critics argue that a service able to reject or hold transactions is less neutral than the label suggests.
Vini Barbosa, a technical writer and documentation engineer building at Ramp Labs, questioned whether permissionless should imply neutrality. He said the product could still be useful while warning that restrictions aimed at unlawful users might also affect people operating under government repression.
NEAR co-founder Illia Polosukhin offered a different interpretation. He said permissionless access means that nobody needs permission to own or transfer assets on the NEAR blockchain, or to deploy contracts there. It does not require every application or liquidity provider built on the network to process every transaction.
NEAR Intents said it would remain permissionless infrastructure, but with defined boundaries, including efforts to prevent the laundering of hacked funds. The dispute therefore concerns not only the Bitget recovery effort, but also how responsibility is allocated between a base blockchain and the applications that provide services on top of it.
Contrast with THORChain and the Bitget breach
NEAR’s decision differs from the position taken by THORChain. That swap network has resisted Bitget’s request to block addresses associated with the attack, arguing that its emergency controls are intended to protect the protocol rather than selectively freeze funds.
A CoinDesk analysis cited in the source material identified about $6.3 million in completed ether-to-bitcoin swaps from one wallet linked to the Bitget attacker. The comparison highlights the different choices available to cross-chain services: one can use transaction screening and intervention, while another can prioritize open access and limit emergency controls to the network itself.
Bitget disclosed the breach on September 24, saying attackers had bypassed security controls protecting its exchange wallets. The exchange later said it had fixed the vulnerability, published addresses associated with the attackers and offered bounties for eligible efforts to freeze or recover the stolen assets.
Circle and Tether, the issuers of USDC and USDT, had already frozen about $320,000 in stablecoins linked to the breach, according to earlier CoinDesk reporting. Stablecoins are crypto tokens designed to track the value of a reference currency, commonly the U.S. dollar. Issuers can sometimes freeze tokens held at identified addresses, making them a significant part of recovery efforts in some hacks.
Moneyiar market picture
Moneyiar data recorded on September 25, 2026, at 22:03 +03:30 showed NEAR Protocol at $4.9081066872, up 6.57% over 24 hours and 30.49% over seven days. The data concerns the NEAR token and does not indicate the value of funds intercepted by NEAR Intents.
At the same time, FUNToken was priced at $0.0079030561, up 1.32% in 24 hours and 9.98% over seven days. Altlayer stood at $0.0079349692, up 2.12% over 24 hours and 11.96% over seven days. Loaded Lions was $0.0015216297, up 0.35% over 24 hours but down 1.38% over seven days. These figures are Moneyiar market data at the stated times.
