Skip to content

Back to the catalog

NEAR Stopped Bitget's Hackers Without Breaking Privacy
bankless.comarticle

NEAR Stopped Bitget's Hackers Without Breaking Privacy

Following the ~$387.5M Bitget hack on September 24th (attributed to North Korea-pattern tactics), attackers tried to launder funds via crosschain rails: THORChain refused Bitget's request to block the hacker's address and later saw $6M+ swapped through it, while NEAR Intents' SHIELD risk-intel layer rejected nearly all of a $50M+ attempted transfer, letting only $166k through. The piece explains the architecture: deposits/withdrawals are public on-chain transactions, but balances/routes/trades happen inside NEAR's Confidential Intents, and SHIELD acts as a gate checking public deposit addresses against shared stolen-funds intel before allowing Intents execution — without unmasking or freezing wallets, since Intents sits atop NEAR's consensus rather than being part of it. It also notes SHIELD's limits (funds simply got rerouted elsewhere) and NEAR co-founder Illia Polosukhin's pitch to make SHIELD shared infra other protocols can adopt.

TL;DR NEAR Intents' SHIELD address-screening layer blocked $50M+ of Bitget-hack laundering attempts while THORChain let $6M+ through, illustrating a privacy-preserving compliance-gate design for crosschain protocols.
Open original ↗
Document

What it is

Analysis of how NEAR Intents' SHIELD risk-intel layer blocked the laundering of funds from the ~$387.5M Bitget hack (Sept 24, matching North Korean patterns), contrasted against THORChain's refusal to intervene. The summary already carries the core outcome ($166k of $50M+ through SHIELD; $6M+ through THORChain) and the architecture. What follows is the concrete detail it omits.

How it works — the laundering playbook this defeated

The specific attacker technique, which the summary skips: the thieves first swapped stolen USDT and USDC into ETH and BNB to escape Tether's and Circle's issuer-level freeze powers (stablecoin issuers can freeze addresses; native L1 assets cannot). Only after converting to non-freezable assets did they seek crosschain exit rails. This is the ordering that matters — freeze evasion happens at the stablecoin→native swap step, before the crosschain hop.

SHIELD's gate sits at deposit-address ingestion: it checks the public deposit address against industry-shared stolen-funds intel and declines execution, without touching Confidential Intents state. Because Intents is a layer atop NEAR consensus (not part of it), SHIELD can only refuse trades — it cannot freeze NEAR wallets or reverse settled transactions.

Track record / comparison data

The one hard comparative figure the summary lacks: THORChain facilitated 72% of the stolen ETH moved after the ~$1.4B Bybit hack (February 2025), positioning it as the recurring exit ramp. THORChain justified its Bitget non-intervention by likening its neutrality to Bitcoin and Ethereum. Supported deposit/withdrawal chains named: Bitcoin, Ethereum, Zcash.

Caveats

  • Not a containment mechanism. Blocked funds were simply rerouted to other protocols — SHIELD raises cost, it doesn't recover or trap.
  • Effectiveness depends on shared intel latency; it only blocks addresses already flagged in the shared feed, so first-mover deposits before flagging can pass (consistent with the $166k that slipped through).
  • Governance risk is unresolved. The author's answer to "could a government abuse this to block dissidents?" is speculative — SHIELD would reject such requests, or users would fork the list. That is an assertion, not a designed guarantee.
  • Adoption as shared infra (Polosukhin's pitch) is a proposal, not deployed cross-protocol.

Technologies named here

Techniques named here

  • Cross-chain fund laundering via asset swaps
  • Address screening against stolen funds intelligence

Threat actors named here

Also named here

  • Bitget hack
  • Bybit hack
  • Gracy Chen
  • Illia Polosukhin

Related in Blockchain