Blocking $50 million from the Bitget hack opens NEAR Intents to wider claims, a lawyer says

THORChain carried roughly 82% of the Bybit haul ^[2]. The interview does not say how large the Bitget hack was or how much of it went through THORChain, so NEAR's $50 million is the only hard Bitget figure ^[7]. At 5% of the $50 million stopped, the bounty NEAR declined comes to about $2.5 million ^{[8] [1]}.

Yuriy Brisov of D&A Partners was asked whether THORChain had a duty to block ^[2], and he put the protocol's position in one line. He said its only protection is that it is decentralized ^[11]. He called that "the strongest defense for any DeFi protocol" ^[12]. It held for Uniswap, where a judge in March dismissed a suit by investors who had bought 38 rugpull and scam tokens ^[13].

By the same reasoning, NEAR's block is evidence of control. Once a protocol has used it, Brisov said, a claimant can ask: "Why do you use it in one case and not use it in another case? Why don't you check all your token issuers on your platform?" ^[14] Bitget thanked NEAR for the block ^[10]. Decentralization maximalists are attacking it for not being permissionless enough ^[9].

THORChain's own position has a weak point in the May halt ^[3]. The protocol says an automated system triggered that stop and that it cannot block particular addresses ^[15]. It has retired its admin key and has no easy way to censor addresses ^[4]. Asked whether that is a defense, Brisov said: "It might be. We don't know yet, because it hasn't been challenged yet." ^[16]

His test for a safe block turns on who decides. An oracle that blocks automatically, where "there is no person who sits and presses a button," passes. "Then it's okay," he said ^[17]. A team that spots illicit activity and presses the button manually "still makes the project not fully decentralized from the legal perspective," he said ^[18]. Cointelegraph describes SHIELD as automated ^[7].

The dispute can resolve in a few ways. A claimant who goes after THORChain first could persuade a court that the May halt proves it can stop flows when it chooses. Someone suing NEAR over an unrelated token loss could cite the Bitget block as proof it could have screened issuers. Or nobody sues, and each protocol pays only in reputation. In my view NEAR carries more legal exposure than THORChain on this record. Brisov's argument treats intervention as the evidence, and NEAR's intervention came with a $50 million figure and Bitget's public thanks attached ^{[7] [10]}. The counter-case is Brisov's own automation test: if no person pressed SHIELD's button, NEAR sits on the side he calls okay ^[17]. The view is wrong if a court holds a keyless router liable for passing known stolen funds, or treats an automated block as control.