Following the Bitget crypto exchange hack, the attackers attempted to swap stolen assets through NEAR Intents, Chainflip and THORChain — services that allow transactions without prior permission. Their responses differed: the first two rejected the swap attempts, while THORChain said it could not selectively block addresses or transactions.
The situation raised a familiar question: does permissionless access to a decentralised protocol mean it must remain neutral towards every transaction?
On 24 September 2026, crypto assets worth $387.5 million were stolen from Bitget’s hot wallets. The exchange suspended withdrawals but said that users’ assets were safe and that its protection fund, worth more than $464 million, would cover the losses in full.
Some of the stolen funds were frozen: stablecoin issuers Tether and Circle blocked $318,000. However, the attackers converted most of the stolen coins into Ethereum (ETH) and bitcoin through decentralised swap services.
According to a report published by the NEAR team on 28 September, the Bitget attackers attempted to move more than $50 million through NEAR Intents. Its built-in SHIELD system stopped the swap and enabled $503,000 to be frozen. Around $166,000 had already passed through the service.
The incident showed that NEAR Intents, which had been expected to treat transactions neutrally, could intervene in transfers and freeze funds. The team explained that the protocol incorporates numerous monitoring mechanisms from across the market and uses the resulting data to decide how transactions are processed.
A similar situation arose with Chainflip. According to Wu Blockchain, the protocol rejected an attempt to swap stolen assets but did not freeze them. Instead, it returned the deposit directly to the sender — the attackers.
THORChain took a different position. When the Bitget hacker began converting funds into bitcoin through the protocol, the exchange’s CEO, Gracy Chen, formally asked it to stop the transactions. The THORChain team responded that it could not selectively block individual addresses or transactions.
The developers explained that the network’s halt mechanism is designed to protect the protocol as a whole, rather than restrict specific participants. They described the decentralised THORChain protocol as inherently resistant to censorship and as a neutral tool. Whether it is used for good or harm, they said, is up to the people using it.
Against this backdrop, NEAR and RUNE prices moved in opposite directions. NEAR fell by roughly 10% following the announcement that the swap had been blocked. Over the same period, RUNE reached its highest price since November 2025, briefly touching $0.84. When the original article was prepared on 29 September, it was trading at around $0.78.
The services’ decisions sparked a broad debate within the crypto community. Commenting on NEAR Intents’ actions, Gracy Chen said: “This is exactly what a permissionless system should look like, without facilitating the movement of funds known to be stolen.”
Supporters of the opposing view argue that a service describing itself as permissionless should remain neutral. One crypto community member quoted by CoinDesk expressed this position.
Taisiya Romanova, a crypto expert and author of the GFiS Channel on Telegram, noted that applying the principles of freedom and decentralisation in practice remains a delicate issue.
“I would venture to suggest that, in NEAR’s case, business interests took priority when the decision to freeze the funds was made,” she said.
In Romanova’s view, the developers probably consider it important to preserve their company’s ability to operate within Western legal frameworks. Western companies also conduct most of the investigations and label cryptocurrency linked to incidents as it moves through various services.
Romanova cited the legal proceedings surrounding crypto mixer Tornado Cash, which have been ongoing for several years. One of the central questions is whether software creators bear responsibility for their users’ actions.
She referred to the arrests of two Tornado Cash developers in connection with third parties’ use of the mixer. The case set a precedent, and the situation remains unresolved four years later: as of late September 2026, the court proceedings are still ongoing.
Romanova believes that bridges citing technical limitations within their protocols as the reason they cannot block funds could potentially face similar problems in the future.
Every channel in the catalogue is checked by the editors against one method: it is how we work out the rating, place a channel at a risk level and decide whether it belongs in Market Scam.