← The Polylog Crypto Intelligence Brief
Morning Edition · Tuesday, September 29, 2026Published at 1:41 AM EDT · New York
THORChain Declines to Block Bitget Hacker as NEAR Intents Says It Rejected $50 Million in Stolen Flows
The two responses to the same $387.5 million theft show that freezing stolen crypto now depends entirely on which layer of infrastructure the funds pass through.
Five days after attackers took $387.5 million from Bitget, the exchange's attempt to get the stolen funds blocked has produced two opposite answers from two pieces of crypto infrastructure.
THORChain, the cross-chain swap network, declined Bitget's request to blacklist addresses tied to the September 24 breach, saying its emergency controls can pause network-wide activity but cannot single out one address or transaction. While THORChain stated that position, CoinDesk counted 27 successful swaps that moved roughly 2,390 ether into 75.2 bitcoin, worth about $6.3 million, through the network. crypto.news reported the same conversion, which turns assets that could be frozen into bitcoin, an asset with no issuer able to freeze it.
NEAR Intents responded differently. Its risk layer, SHIELD, rejected more than $50 million in attempted transfers tied to the attacker and froze $503,000 mid-execution, letting roughly $166,000 through, according to the team. NEAR Intents also said it would waive the 5 percent bounty Bitget offered for freezing funds, so that more value returns to the exchange. It said frozen amounts would be returned through a legal process.
Bitget has described the incident as an unauthorized party circumventing its protective measures and has not published a detailed technical root cause. The pattern reported so far, a centralized exchange losing custody of assets in one event and the proceeds moving out across chains, is consistent with compromise of exchange-controlled keys or internal access rather than a flaw in any public contract. On the withdrawal side, Chief Executive Officer Gracy Chen said Bitget had processed 9,585 withdrawal orders totaling 4,098.036 bitcoin after reopening the queue, a test of Bitget's reserves that the exchange has met so far.
The dispute is about where discretion sits. A swap protocol that can only halt everything or nothing behaves as its designers intended, but it cannot help victims. An intent-based router that screens quotes before execution can help victims, but it also creates a control point that could be used against any user.
Veracity: Corroborated
84/100Part of a tracked trend
Freezing Stolen Crypto Becomes an Infrastructure Policy Choice
After each large theft, recovery will hinge less on law enforcement than on which intermediaries choose to screen transactions, so every router, bridge and issuer is pushed to adopt an explicit freezing policy and the market fragments into compliant and non-compliant rails.
Townsquare
Start a discussion in Townsquare.
More from this edition
- Aztec Discloses Critical Proving-System Flaw in Its Alpha V5 Privacy Network
- Chainlink Rebuilds Its Bridge Software to Let Banks Run Their Own Transfer Checks
- Compound Delegates Say the Foundation Used DAO Reserves to Buy the Votes That Approved Its Own Budget
- Senate Democrats Call Tether's USDT a Financial Lifeline for Iran and Ask Treasury to Investigate
- Goldman Sachs Opens Its $100 Billion Treasury Fund to Crypto Trading Desks Without Tokenizing It
- Restaking Economics Collapse and Ether.fi Cuts Its Last Structural Tie to EigenLayer
- CFTC Registers Coinbase Clearing, Allowing USDC as Collateral and Round-the-Clock Derivatives Settlement
Comments
2Sep 29, 5:41 AM · edited
SHIELD rejected rather than seized, so that $50 million stays spendable and merely reroutes, which predicts rising volumes through networks whose emergency controls are network wide rather than address level.
Sep 29, 2:00 PM · edited
NEAR's own numbers say it actually froze $503,000 and let about $166,000 through, while the $50 million was deflected to other providers, so screening at one layer relocates the flow rather than stopping it.