NEAR Intents, a cross-chain intent-based swap protocol built on the NEAR blockchain, says its built-in risk-intelligence layer SHIELD detected and blocked more than $50 million in attempted laundering tied to the September 24 breach of the exchange Bitget, which lost $387.5 million in the incident.

Of the flagged transactions, approximately $166,000 slipped through the system, while another $503,000 was frozen mid-execution, according to the protocol's account of the incident. Bitget CEO Gracy Chen publicly praised NEAR Intents for its role in disrupting the laundering process.

NEAR Intents also waived its right to a 5% bounty on the frozen and recovered stolen assets — a fee that, applied to more than $50 million in flagged transactions, would have represented a substantial payout under the industry's customary white-hat recovery terms.

How SHIELD works

Under normal conditions, NEAR Intents processes over $100 million in daily cross-chain swap volume. SHIELD aggregates signals from multiple intelligence and compliance providers to identify transactions linked to known exploits, sanctioned wallets, or suspicious behavioral patterns. When the Bitget funds began moving, the system flagged them almost immediately.

The protocol draws a deliberate distinction between "permissionless" and "neutral." A permissionless system lets anyone transact without gatekeepers; a neutral one treats all transactions as morally equivalent. NEAR Intents positions itself as the former without the latter — processing legitimate swaps freely while filtering out provably stolen assets.

After the initial detection, the protocol redirected the majority of suspicious flows to alternative providers. In practical terms, the stolen assets could not re-enter clean circulation through NEAR Intents' infrastructure.

Operational significance

The $166,000 that bypassed the filters represents roughly 0.3% of the flagged amount. The $503,000 frozen mid-execution carries particular technical weight. Cross-chain swaps are typically designed to be atomic — either the entire transaction completes or none of it does. That SHIELD can pause execution mid-stream without breaking the protocol's core functionality points to a deliberate intervention mechanism at the settlement layer rather than a simple pre-trade screen.

For Bitget and its affected users, $50 million in blocked laundering does not make them whole on a $387.5 million loss. What it does is slow the attackers' ability to convert stolen assets into spendable funds, extending the window for recovery efforts across the broader ecosystem — including exchanges, chain analytics firms, and law enforcement that track laundered flows across venues.

Compliance as infrastructure

The incident is a concrete data point in an ongoing debate over whether decentralized infrastructure can enforce sanctions and theft-related controls without sacrificing composability. NEAR Intents' argument — that permissionless rails and stolen-asset filtering are compatible — has now been tested against a live, nine-figure exploit rather than a theoretical scenario.

The episode also raises the bar for competing cross-chain protocols. As launderers increasingly route proceeds through intent-based swap systems rather than centralized exchanges, the presence or absence of a SHIELD-style risk layer is likely to become a differentiator for institutional counterparties and liquidity providers deciding where to route flow.

The Bitget recovery effort is ongoing, and the roughly $50.7 million in blocked and frozen funds tied to the breach represents a recoverable pool that will depend on coordination between NEAR Intents, Bitget, and any intervening jurisdictions before the stolen assets can be returned to affected users.