NEAR Intents froze part of the Bitget attacker's flow while THORChain let millions through, and the numbers show how small the frozen share really was.
The attacker behind last week's Bitget exchange breach has been shopping for exits across decentralized infrastructure, and two cross-chain protocols have now given starkly different answers.
NEAR Intents, a protocol that settles trades across blockchains based on user "intents," said its automated SHIELD system flagged wallets linked to the hacker. Of more than $50 million in attempted transfers, the protocol froze about $503,000, while roughly $166,000 got through.
THORChain took the opposite approach, publicly declining to block the same actor and allowing about $6.3 million of stolen ether to be swapped into bitcoin as recently as Monday.
Doing the math
The figures put NEAR Intents' role in perspective. The frozen and completed amounts together total about $669,000, or roughly 1.3% of the $50 million the hacker tried to move. Of the funds that actually reached the protocol, about three-quarters were stopped and a quarter slipped past. THORChain, by comparison, processed nearly ten times more hacker money than NEAR Intents handled in total.
Alex Shevchenko, a NEAR Intents co-founder, acknowledged the scale. "NEAR Intents routinely processes $100M+ of crosschain trading volume in a day. Yet in this case, only a negligible fraction of the hacked funds were flowing through us," he said. The SHIELD system, he explained, detects unusual flow patterns using know-your-transaction screening and inputs from intelligence providers.
What each posture signals
The contrast is the real story for investors. Both protocols market themselves as permissionless infrastructure, yet one has built a screening layer and the other has chosen not to use one. The practical effect of NEAR's screening appears to have been to push most of the attacker's flow elsewhere, rather than to capture it.
That leaves an unresolved governance question. When an automated system freezes funds, someone has to decide how wrongly frozen assets get released, and who holds that authority on a protocol that describes itself as decentralized.
The regulatory overhang
Forensic analysts have pointed to wallet overlaps between the Bitget theft and earlier heists tied to North Korea, including the Bybit breach. If that link is formally established, every venue that processed the funds would face sanctions exposure. THORChain's refusal to intervene would then look less like a principled stance and more like a compliance liability.
The development to track is whether other cross-chain protocols adopt screening similar to SHIELD in the coming weeks. A wave of adoption would signal that the industry sees THORChain's position as a risk rather than a model.