NEAR Intents says its SHIELD security system blocked more than $50 million in attempted transfers linked to the Bitget hack, drawing a sharp line between itself and THORChain - which refuses to censor attacker funds. The protocol also froze $503,000 mid-execution, while about $166,000 slipped through, CoinTelegraph reported.
The announcement lands days after THORChain rejected Bitget's plea to block the hacker's wallets, turning the industry's biggest theft of 2026 into a live referendum on what permissionless infrastructure owes its victims.
What SHIELD caught
NEAR Intents routes cross-chain swaps through a network of solvers. General manager Alex Shevchenko said attackers tried to push stolen assets through that pipeline after scattering them across chains, and SHIELD - which screens flows using transaction patterns plus blockchain-intelligence and know-your-transaction providers - refused to quote most of it before settlement, or halted transfers already underway.
The $50 million figure is a deduplicated estimate that Shevchenko cautioned could carry attribution errors of up to 10% - and it is not recovered money. Blocked flows simply went to other providers. The $503,000 caught mid-execution stays frozen pending legal recovery, and NEAR Intents is waiving both halves of Bitget's 5% bounty so more returns to the exchange, CoinInsider reported. Bitget CEO Gracy Chen confirmed the intervention.
Two philosophies collide
Shevchenko framed it as a choice, not a constraint: permissionless systems don't have to be neutral, because their builders decide what the protocol enables. "Refusing to help launder stolen assets is one of ours," he said. "A financial system where stealing an asset gives you an unrestricted right to monetize it isn't a freer system. It is simply a system that protects the thief."
THORChain's answer remains the opposite: it doesn't censor by design, and past network halts were broad emergency measures, not selective freezes. Centralized issuers split the difference with their built-in kill switches - Circle and Tether blacklisted an attacker-linked Ethereum address holding 99,990 USDC and 218,023 USDT, about $318,000 combined, after Bitget posted its 5% recovery bounty.
The $387.5M hunt continues
Bitget's latest accounting puts the Sept. 24 theft at $387.5 million, up from the first $351.6 million estimate, after tracing additional Zcash and Tron assets. Investigators say attackers compromised a backend component of the wallet infrastructure rather than simply stealing keys.
Most of it hasn't moved. AMLBot estimated $343 million - 88% of tracked funds - sitting dormant across 13 attacker wallets: 68,300 ETH, 83 million XRP, and 18,900 ZEC. With Bitcoin withdrawals already reopened and the XRP tranche frozen in place by Ripple's own design limits, NEAR's $503,000 may be the first seized funds with a real path home, Finwire reported.