NEAR Defends Blocking Bitget Hack Funds, Says Permissionless ‘Doesn’t Mean Neutral’

HACK OR EXPLOITNEAR Defends Blocking BitgetHack Funds, Says Permissionless‘Doesn’t Mean Neutral’44IMPORTANCECLOSED5NEWS MEDIA5PIECESSep 29, 2026 14:05blockboard.net

After the September 24 Bitget hack, several cross-chain services and other protocols moved to block or freeze related transfers, while some attempted transfers still slipped through or landed on the wrong network. Bitget later reopened withdrawals, and its reported asset balance remained above $6.7 billion after the incident.

What this rests on

Claim by claim, with its source
✓
Chainflip rejected a deposit after about 100 Solana tokens entered its vault, and the funds were returned to the wallet.
✓
On September 24, Bitget was hacked, and the stolen amount was reported at roughly $388 million.
✓
By September 29, NEAR Intents and Chainflip had joined Tether and Circle among the protocols that had turned away or frozen funds tied to the hack.
✓
NEAR Intents said its SHIELD system detected more than $50 million in attempted transfers linked to the hack and stopped most of them, with about $503,000 frozen mid-execution.
✓
NEAR Intents said about $166,000 moved through its swap system, and Bitget waived NEAR Intents’ share of the recovery bounty.
✓
Security firm SlowMist said stolen Bitget funds were being converted to Bitcoin through CoW Protocol orders paired with Chainflip deposit addresses, while Chainflip tried to block those flows.

What it means

Who it affects, what changes and what is still unconfirmed

Each sentence links inside to the piece that supports it.

Users moving assets across NEAR Intents and Chainflip are seeing more transfers stopped, frozen, or returned than before, and that changes what is immediately reachable through those routes. Bitget users also saw withdrawals reopen after the hack, while the exchange said it still held more than $6.7 billion in assets after the incident.

In practice, cross-chain swap routes are now being used with more active screening than before, and some flows linked to the hack have been blocked before completion. That does not change the fact that some funds still moved through the swap system and some transfers still landed on the wrong network or in the wrong channel.

Market reaction

NE NEAR Protocol it is the asset of the company or protocol in the event from 2 h before to 4 h after the line marks the first headline
published
-1.02 % before publication
+1.45 % after
$5price at publication
12series points

How the story was built

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Sep 29 10:03
+27 min
Sep 29 10:29
CR Cryptopolitan adds
Adds $388M and $100M, with quotes
+4 h 1 m
Sep 29 14:03
The Defiant echo
No new facts: proceeding, transfers, attempted; with quotes
+6 h 40 m
Sep 29 16:42
+1 d 7 h
Sep 30 17:03
CR CryptoPotato adds
Brings into the story: BTC, with quotes

Thefts of a similar size

WhenWhat happenedFigure
2 months ago Nesa incident $50M
1.6 years ago Infini incident $50M
2.0 years ago Radiant Capital incident $50M
5.9 years ago Saffron Finance · Contract vulnerability incident $50M
8.7 years ago Blockchain.info · Phishing attack incident $50M

4197 incidents stored · 125 were as large as this one or larger ($50M)

What could happen next

What the prediction markets currently price as likely. This is context, not a forecast of ours: there is money on it, and that is all we show.

0 % no series
Kalshi · $1,148,516 of open interest · resolves on Oct 2, 2026
0 % no series
Kalshi · $1,135,683 of open interest · resolves on Oct 6, 2026
8 % -1 pts
Kalshi · $1,020,972 of open interest · resolves on Jan 1, 2027
5 % no series
Kalshi · $874,949 of open interest · resolves on Oct 1, 2026