On September 24, Bitget lost approximately $387.5 million in an attack that, surpriseclosely matches known North Korean hacker patterns.
As a result, the culprits quickly dispersed the loot into more defensible positions, wasting no time in swapping the stolen USDT and USDC for ETH and BNB to circumvent any freeze of Tether and Circle.
Once these exchanges were made, it was time to escape. Many protocols were addressed to achieve this flight, including crosschain rails like THORChain and NEAR Intents. However, the results obtained by hackers were markedly different across these two particular platforms.
After Bitget CEO Gracy Chen officially asked THORChain to deny service to addresses tracked by the attackers, THORChain refused, comparing its “neutrality” to that of Bitcoin and Ethereum. Since then, a wallet linked to a hacker has exchanged over $6 million worth of ETH into BTC via the protocol.
Conversely, when attackers attempted to move +$50 million through NEAR Intents, the solver’s network risk intelligence layer, SHIELDrefused almost everything. Only $166,000, a fraction of the attempted funds, was disclosed.
The Bitget Hack: what we saw at NEAR Intents
On September 24, @bitget was hacked. Approximately $387.5 million in funds were stolen. A significant portion of these funds moved across chains, primarily to Ethereum. Hackers tried to break through
X (formerly Twitter) • Alex Shevchenko 🇺🇦
This defensive mechanism has naturally provoked mixed reactions. Many people in the industry welcomed the move, calling it balanced and sensible. Why let bad actors win when you can block them in a way that doesn’t affect UX or regular user confidence?
On the other hand, backlash has also emerged since NEAR delved into permissionless privacy via Confidential Intents. If NEAR can find and stop the hacker’s money, what’s to stop them from doing the same thing to you later under different circumstances??
To get into the nuance here, it is useful to understand how the mechanisms work.
Deposits and withdrawals from NEAR Intents are ordinary transactions on Bitcoin, Ethereum, Zcash, etc. Anyone with a block explorer can see them. What is it in betweensuch as sales, itineraries, exchanges, etc., which live in confidential intentions.
Do you like this article?
Subscribe to Bankless or log in
As such, SHIELD functions de facto grid at the entrance to this system. It checks public deposit addresses against stolen funds information that much of the industry already shares, then denies access to nefarious accounts.
In this sense, nothing confidential was ever “open” when NEAR denied the Bitget attackers. And SHIELD’s range is also limited. As because you noticeIntents is a crosschain layer at the top NEAR rather than part of the chain consensus. SHIELD decides which transactions will be executed, but it cannot freeze NEAR wallets or reverse completed transactions.
— (@)
So the Bitget incident was an example of how SHIELD stopped hackers without affecting/preventing/unmasking regular users. They were essentially blocked from entering once questionable addresses appeared in SHIELD.
But could this system be misused in the future? For example, we can imagine a despotic government making formal calls to stop legitimate funding from its domestic political opposition. In this case, however, I imagine SHIELD would reject the requests, or people would disclose the questionable addresses.
This implementation is certainly a savvy and moral implementation that makes NEAR unviable for moving large amounts of illicit funds. He Also positions NEAR as a compliant alternative to its more impartial competitor, THORChain (which facilitated 72% of stolen ETH moved after the $1.4 billion Bybit Hack in February 2025).
Both projects have some human levers in various places. Yet one has become a cross-chain powerhouse that rejects stolen funds, while the other has become the go-to exit ramp for the biggest crypto heists.
To be clear, I think it’s good that there are neutral channels, networks, apps, etc. How to combat crime in these contexts is complicated and always involves compromises and different philosophies. I also think it’s good to experiment with new techniques to end the scourge of North Korean hackers.
— (@)
And SHIELD is still not a panacea. The Bitget funds he blocked were simply routed by the culprits to other protocols. This is why Illia Polosukhin, co-founder of NEAR, SHIELD cast as a shared infrastructure that other protocols can connect to, thereby improving the ecosystem’s data.
If this leads to a new paradigm of solutions private to users but hostile to thieves, and with open transparency on their main levers, then the mechanism was definitely worth a try. Now let’s see if other high-profile crypto projects also take this approach.
About the Author
