# THORChain Declines to Block Bitget Hacker as NEAR Intents Says It Rejected $50 Million in Stolen Flows

The two responses to the same $387.5 million theft show that freezing stolen crypto now depends entirely on which layer of infrastructure the funds pass through.

- Published: 2026-09-29T05:41:12.286Z
- Canonical: https://polylog.news/crypto/2026-09-29/thorchain-declines-to-block-bitget-hacker-as-near-intents-sa
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [CoinDesk](https://www.coindesk.com/tech/2026/09/28/thorchain-rejects-bitget-request-to-block-hacker-as-usd6-million-moves-to-bitcoin), [crypto.news](https://crypto.news/bitget-hacker-moves-6-3-million-into-bitcoin/), [CryptoSlate](https://cryptoslate.com/nearly-5000-btc-leaves-bitget-as-hackers-begin-laundering-387-million-haul/), [Polylog editors](https://polylog.news)

Five days after attackers took $387.5 million from Bitget, the exchange's attempt to get the stolen funds blocked has produced two opposite answers from two pieces of crypto infrastructure.

THORChain, the cross-chain swap network, [declined Bitget's request](https://www.coindesk.com/tech/2026/09/28/thorchain-rejects-bitget-request-to-block-hacker-as-usd6-million-moves-to-bitcoin) to blacklist addresses tied to the September 24 breach, saying its emergency controls can pause network-wide activity but cannot single out one address or transaction. While THORChain stated that position, CoinDesk counted 27 successful swaps that moved roughly 2,390 ether into 75.2 bitcoin, worth about $6.3 million, through the network. [crypto.news reported the same conversion](https://crypto.news/bitget-hacker-moves-6-3-million-into-bitcoin/), which turns assets that could be frozen into bitcoin, an asset with no issuer able to freeze it.

NEAR Intents responded differently. Its risk layer, SHIELD, [rejected more than $50 million in attempted transfers](https://t.me/cointelegraph/72383) tied to the attacker and froze $503,000 mid-execution, letting roughly $166,000 through, according to the team. NEAR Intents also said it would waive the 5 percent bounty Bitget offered for freezing funds, so that more value returns to the exchange. It said frozen amounts would be returned through a legal process.

Bitget has described the incident as an unauthorized party circumventing its protective measures and has not published a detailed technical root cause. The pattern reported so far, a centralized exchange losing custody of assets in one event and the proceeds moving out across chains, is consistent with compromise of exchange-controlled keys or internal access rather than a flaw in any public contract. On the withdrawal side, Chief Executive Officer Gracy Chen said Bitget had [processed 9,585 withdrawal orders totaling 4,098.036 bitcoin](https://cryptoslate.com/nearly-5000-btc-leaves-bitget-as-hackers-begin-laundering-387-million-haul/) after reopening the queue, a test of Bitget's reserves that the exchange has met so far.

The dispute is about where discretion sits. A swap protocol that can only halt everything or nothing behaves as its designers intended, but it cannot help victims. An intent-based router that screens quotes before execution can help victims, but it also creates a control point that could be used against any user.

## What this means

The mechanism at work is the interception point, not chain neutrality. Stolen funds move through routers, swap networks and issuers, and each one now makes its own policy choice, so an exchange's odds of recovery depend on the route an attacker picks rather than on any shared rule. Exchanges and their insurers lose when neutral venues dominate the route, while intent layers and stablecoin issuers gain commercial leverage by offering screening as a product. The precedent is the Ronin and Harmony thefts, where issuer freezes and centralized off-ramps recovered part of the proceeds while permissionless swap venues did not. The likelier outcome over the coming months is that large exchanges route listing, integration and liquidity toward infrastructure that screens transactions, while attackers concentrate on venues that do not. That would push the conversion of stolen assets into bitcoin and privacy assets earlier in the laundering chain. That forecast fails if THORChain validators vote in a targeted address-level control. Such a change would remove the clearest example of a venue that cannot comply.

## What to watch

- Whether THORChain node operators bring a targeted blocking mechanism to a vote, a move that would show economic pressure from exchanges can change a protocol that says it cannot discriminate.
- Whether the 4,098 bitcoin already withdrawn from Bitget is followed by further outflows, since a continued queue would indicate customers doubt the exchange's reserve coverage.
- Whether Bitget publishes a root-cause report naming the access path that failed, which determines whether other exchanges can check for the same weakness.