NEAR Intents Flags Over $50M in Bitget Hack Flows, Freezes $503K

Highlights:

• NEAR Intents detected over $50 million in Bitget hack-related flows and froze about $503,000 in stolen assets.
• Only about $166,000 passed through NEAR Intents as SHIELD blocked most suspicious cross-chain transactions linked to attackers.
• NEAR Intents waived its recovery bounty, allowing Bitget to retain more funds recovered from the hack.

NEAR Intents, a cross-chain crypto protocol in the NEAR ecosystem, detected more than $50 million in attempted fund movements linked to the September 24 Bitget hack. Its SHIELD security system also froze about $503,000 as the attackers tried to move the stolen funds.

Bitget CEO Gracy Chen shared the update on September 28. She thanked NEAR Intents and SHIELD for helping stop part of the stolen funds. Chen also said Bitget will follow the proper legal process to recover the restricted assets. Alex Shevchenko of NEAR Intents said attackers stole about $387.5 million from Bitget. However, he noted that the figures are estimates. The final amounts may differ by up to 10% because some transactions may be misidentified.

Appreciate @near_intents / SHIELD for stepping up on the Bitget incident: flagged $50M+ in attempted laundering flows, froze $503k mid-execution, and waived their own bounty share so we can recover more.

This is what permissionless but not "facilitating known stolen funds"… https://t.co/R7ODgaRA76

— Gracy Chen @Bitget (@GracyBitget) September 28, 2026

Attackers Tried to Move Over $50M Through NEAR Intents

Shevchenko said a large share of the stolen funds moved across different blockchains. Much of the cross-chain activity eventually reached Ethereum and was converted into ETH. The attackers also tried to move more than $50 million through NEAR Intents. However, only about $166,000 passed through the protocol.

NEAR Intents said SHIELD detected the suspicious transfers. SHIELD works as the protocol’s risk-intelligence system. It checks transaction activity using information from crypto security firms, researchers and other industry sources. The system can identify transactions connected to known hacks. NEAR Intents can then reject a transaction before it starts. SHIELD can also stop a transfer while it is already being processed.

During the Bitget incident, SHIELD froze about $503,000 in stolen funds during execution. The assets remain restricted while Bitget works through the legal and recovery process. NEAR Intents said its platform normally handles more than $100 million in daily cross-chain trading volume. Despite that activity, only a small portion of the stolen Bitget assets successfully moved through its system.

NEAR Intents Waives Its Bitget Recovery Bounty

NEAR Intents also decided not to take a share of Bitget’s recovery bounty. Bitget previously announced a bounty program for people or organizations that help recover stolen funds. The exchange offered 5% for helping freeze assets and another 5% for helping complete their recovery.

NEAR Intents said it would waive its own bounty. The team wants Bitget to recover as much of the stolen crypto as possible. Chen praised the decision. She said public blockchains can remain open while also stopping known stolen funds from moving through their systems.

NEAR Intents said open access does not mean protocols should help attackers move stolen funds. The team plans to keep the platform permissionless while using SHIELD to detect hack-related transactions. Bitget and security teams are still tracing the stolen assets across different blockchains and cross-chain services. NEAR Intents will keep the frozen $503,000 restricted until the legal recovery process determines how to return the funds.

Bitget has also started restoring withdrawals in phases after the September 24 security incident. Bitcoin withdrawals resumed first, with other assets and services returning gradually as the exchange continues its recovery process.

Bitget has begun the phased resumption of withdrawals following the security incident identified on September 24, with BTC withdrawals on the Bitcoin network started at 08:00 UTC on September 28 as scheduled.

The resumption follows additional security work across Bitget's…

— Bitget (@bitget) September 28, 2026