NEAR Intents Says SHIELD Blocked $50M in Bitget Funds

HypeMeter

High attention and emotional sentiment detected.

The figure needs context. Only about $669,000 actually moved through the platform, according to NEAR Intents. So the headline number describes rejected quotes, not funds seized.

What NEAR Intents Says SHIELD Stopped

NEAR Intents GM Alex Shevchenko posted the primary account on X. He said SHIELD detected $50 million-plus in laundering flows after filtering duplicates. He also flagged a self-declared error band of up to 10%.

The real interactions were small. About $166,000 slipped through, according to Shevchenko. SHIELD then froze another $503,000 mid-execution, and that sum now sits restricted pending recovery.

No public transaction hashes back the $50 million yet. Shevchenko cited internal logs, the Bitget tracer, and Arkham data. So far, no independent firm has published a matching on-chain reconstruction.

How the Bitget Hack Happened

The Bitget hack began at 18:31 UTC on September 24, 2026. Attackers drained several hot wallets across eight networks. Bitget first estimated the loss at $351.6 million in its security notice.

On September 25, Bitget revised the confirmed outflow to about $387.5 million. It added Zcash and TRON assets to the count. The company called it fuller accounting, not a second theft.

CEO Gracy Chen said the attackers never stole a private key. Instead, a zero-day in a third-party security product handed them high-level credentials. They then injected fake withdrawal commands into wallet backend systems.

Two tiny test transfers moved first, both below risk thresholds. Larger withdrawals followed about 30 minutes later. Reconciliation flagged the gap at 19:05 UTC, so Bitget paused withdrawals.

Chen counted 17 transactions across eight networks between 18:58 and 20:09 UTC. Together they moved about $361 million, by her account. Bitget also pointed to a User Protection Fund of more than $464 million to cover users.

The $50 Million Number, Explained

The gap between $50 million and $669,000 matters. SHIELD screens swaps at quote time and during execution. When it refuses a quote, the stolen funds simply route elsewhere.

That is exactly what happened here. Rejected flows later went to other providers, according to Shevchenko. So “blocked $50 million” means refused demand, not recovered money.

Independent coverage stressed the same point. CoinDesk and AInvest both noted that only about $669,000 touched the rails. AInvest also highlighted the 10% mislabeling risk in the data.

Where the Rest of the Money Went

Other players moved faster on the parts they could reach. Circle and Tether froze roughly $318,000 in stablecoins at address 0xe07bd590e1198666230932bad5db3dbbe21e7d57 on September 25. That freeze happened on-chain, so anyone can verify it.

THORChain took a different path. It declined to block specific attacker addresses. CoinDesk reported that about $6.3 million in ETH became BTC through one linked wallet.

Cryptopolitan reported that Chainflip also turned some funds away. So the response split across venues. Some screened the flow, while others let it pass.

Permissionless Does Not Mean Neutral

The intercept reignited an old fight over what “permissionless” should allow. NEAR co-founder Illia Polosukhin argued that open money does not force every app to process every transaction. Refusing to launder stolen funds is a choice, he said.

Critics pushed back hard. Developer Vini Barbosa said permissionless does mean neutral, calling it the whole point. Others argued that SHIELD makes NEAR Intents permissioned at the app layer.

Shevchenko framed it as a values call. He said crypto cannot demand property rights while optimizing for stolen property. Still, even he admitted the rejected funds moved on.

Not everyone read the post as pure defense. Analyst zacodil called it partly a SHIELD product launch. The bounty waiver, he noted, doubles as smart announcement design.

How Markets Reacted

The NEAR token barely flinched on the news. It traded near $4.77 on September 29, down about 4% on the day, according to CoinDesk data. Still, NEAR sat up roughly 160% over the prior month.

That rally started well before the SHIELD post. So analysts warn against crediting the whole move to this single event. Bitget’s own BGB token slipped to about $1.96 on September 25, then recovered toward $2.00.

What Happens Next for NEAR Intents

NEAR Intents also waived its Bitget bounty. The program pays 5% of frozen funds plus 5% of recovered funds. The team declined its share so Bitget can return more to users.

Bitget has resumed withdrawals in phases and engaged Mandiant and SlowMist. TRM Labs flagged Lazarus-adjacent clues, though nobody has confirmed North Korea. The frozen $503,000 still waits on a legal process.

The bigger question now sits with builders. More screening tools may follow if this model spreads. For traders, the takeaway is blunt: stolen funds face more friction, yet determined actors still find open doors.

None of this is financial advice. NEAR Intents just showed that app-layer defense can bite, even if it cannot catch every dollar.