Invest1 publisher2 min readPublished
Freezes by NEAR Intents, Circle and Tether catch about $821,000 of Bitget's $388 million
NEAR Intents, Circle and Tether have frozen about $821,000 tied to the $388 million Bitget hack, roughly 0.2% of the haul. THORChain is still processing the attackers' swaps, so refusals by other swap services have so far mostly changed which venue carries the money.
The Investor · Invest desk
What happened
- NEAR Intents general manager Alex Shevchenko said the attackers tried to move more than $50 million through the protocol and almost nothing got through.
- Blockchain-tracking firm MistTrack reported that Chainflip rejected the Bitget exploiter's money and refunded it.
- THORChain turned down a public request from Bitget CEO Gracy Chen to reject funds from the hack.
- A September 28 CoinDesk review of THORChain's public records found about 2,390 ETH swapped into 75.2 BTC, roughly $6.3 million, across about 27 swaps.
- Bitget first put the September 24 loss at $351.6 million and revised it upward after counting transfers on Zcash and TRON.
Compiled by The InvestorSomething wrong?How this is made
Why it matters
- cost NEAR turned away an amount equal to about half its average daily volume. A swap service that refuses hands that flow to whichever competitor accepts it.
- constraint THORChain says its only tool is an emergency halt of the whole network. Acting against one attacker would mean stopping every user while other venues refuse the money.
- exposure Funds NEAR freezes stay locked pending a legal process with no stated release authority or appeal route. Any user its risk layer wrongly flags carries that risk too.
- precedent THORChain volume is the test of whether refusals elsewhere cut the flow. The Bybit hackers took the same THORChain route in 2025 and pushed its volume over $3 billion in five days.
The attackers tried to push more than $50 million through NEAR Intents. Take away what it processed and froze, and more than $49.3 million was refused outright [3]. Those funds, Shevchenko said, "went to other providers" [5]. Chainflip's refund [7] also left the money with the sender.
The money that has actually stopped moving comes from two places. NEAR froze $503,000 mid-swap [4], and Circle and Tether froze roughly $318,000 in USDC and USDT, according to Cryptopolitan [18]. Together that is about $821,000 [1]. The Zcash and TRON transfers that lifted Bitget's estimate after its first count added about $36.4 million [8], about 44 times everything frozen so far [9].
On THORChain, the 27 swaps CoinDesk counted average about $233,000 each [4], all consolidated in a single address [10]. That $6.3 million is about 1.6% of the haul [5]. It is also only what one review of public records had caught by September 28 [10].
Vini Barbosa, a technical writer building at Ramp Labs, wrote to Shevchenko that "permissionless does mean neutral," calling it "the whole point of building something permissionless" [12]. Shevchenko wrote back: "But permissionless doesn't mean neutral," adding, "The people who build these systems make choices about what those protocols enable. Refusing to help launder stolen assets is one of ours." [13] NEAR is giving up money on its side of the argument. It will waive the 5% freeze and 5% recovery bounties Bitget is offering so more of the money returns to the exchange [14]. On the $503,000 it holds, the two bounties together would come to about $50,300 [7].
If the providers that took NEAR's rejected flow freeze a real slice of it, the frozen share climbs off 0.2% [2] and the refusals did close routes. If THORChain's counted flow from these wallets grows from $6.3 million toward the $49.3 million NEAR turned away, the refusals moved the money without stopping it. Neither showing up would mean the funds are idle or moving where no one has counted them.
I think the second reading fits the evidence best. NEAR's own manager says the blocked money went elsewhere [5]. THORChain, the venue that kept serving the attackers [8], is where a public count has found it [10]. That view is wrong if the frozen total reaches the tens of millions, the size of the flow NEAR refused [3].
What to watch
- Whether other cross-chain services publish a split of processed, frozen and refused Bitget funds like the one NEAR Intents gave.
- Further Circle or Tether freezes if the attackers move more of the haul into USDC or USDT.
- How far Bitget's phased withdrawal restart goes beyond Bitcoin and ETH on five networks.