NEAR Intents Hack: Legal Process for Bitget's Stolen Funds, a 48-Hour Deadline for Its Own

The NEAR Intents hack lasted less than two days, and the procedure that ended it says more than the exploit itself. The cross-chain trading service handled stolen crypto twice in eight days, first holding funds taken from someone else and then losing funds of its own. It sent the first case towards courts and police. It closed the second with a public 48-hour deadline and an investigation that stopped the moment the money came back.

Crypto is building two recovery tracks at the same time, one that runs through legal process and one that runs on deadlines set by the people who were robbed. NEAR Intents used both within days of each other, and each choice makes sense once the question becomes who owned the money.

How NEAR Intents handled the Bitget hack money

The first case started at Bitget, where assets worth about $387.5 million left the exchange's hot wallets on 24 September and spread across several blockchain networks.

The exchange's incident update revised an initial estimate of $351.6 million upwards and offered a bounty of 5% on funds frozen and 5% on funds recovered, payable to parties whose action led directly to either outcome.

Part of the stolen assets travelled across chains, and NEAR Intents sat on one of the routes. In a detailed account published on 28 September, its general manager Alex Shevchenko wrote that the attackers tried to push more than $50 million through the service. About $166,000 went through, and roughly $503,000 was stopped halfway through execution and remains restricted until a legal and recovery process decides its fate. He added that the figures are indicative and could be off by up to 10%.

The filter behind those numbers is SHIELD, which Shevchenko described as the service's risk-intelligence layer. It watches for unusual flows and combines signals from know-your-transaction providers, intelligence firms, independent researchers and the largest centralised companies in the industry. A flagged request gets one of two responses: the service declines to quote it, or halts it mid-execution.

His message to Bitget set the first procedure. He asked the exchange to come to NEAR Intents via the police and the courts, leaving a legal process to decide what happens to the frozen money, and said NEAR Intents was giving up its share of the bounty so Bitget could recover as much as possible.

Why a trading service can refuse a transaction

A refusal like this happens above the ledger, at the layer where trades are requested and filled. NEAR Intents lets users state the outcome they want, such as swapping a token on one network for a different token on another, and the service arranges the execution. The underlying chains stay open to anyone with a valid transaction; the choice of what to quote and carry out belongs to the service built on top of them.

Shevchenko framed that choice as a design principle. In his account, building permissionless systems does not make them neutral, because their builders decide what the protocols enable, and refusing to serve as a route for stolen funds is one of the choices NEAR Intents has made. He grounded the choice in property rights: in his view, infrastructure that lets a thief cash out freely sides with the thief, and no economy can be built on it.

He also addressed the wallets that plug the service into their apps, warning that they answer for the providers they choose to connect. Anyone who has worked in a bank's compliance team will recognise the logic: a correspondent bank is expected to vet the banks it connects to, because their customers become its exposure.

Three days later, the victim was NEAR Intents

The roles reversed on 1 October. NEAR Intents posted an incident notice saying its services had been stopped after a bug in how its Omni infrastructure for deposits and withdrawals interacted with its own smart contract. The first estimate put the loss at about $3.8 million, and the team committed to compensating it in full.

The notice described the contract-side flaw as patched and said deposits and withdrawals would stay offline for roughly 12 more hours on 11 networks, including Polygon, TON, Optimism and Avalanche, while the Omni fixes were completed. It also said the police had been notified, that partners in security and on-chain analytics were tracing the funds, and that a detailed report would follow. NEAR Intents was, at that stage, following the same route it had pointed Bitget towards.

A 48-hour window and a closed investigation

The second route opened overnight. Early on 2 October, Shevchenko posted a 48-hour deadline addressed directly to the exploiter, saying the team had identified them and listing three return addresses: one on Bitcoin, one shared by BNB Chain and Ethereum, and one on Solana. He called it the last window for responsible disclosure, the security-research practice of reporting a flaw privately instead of exploiting it. The post named no one and published no evidence.

The money came back the same day. Later on 2 October, Shevchenko wrote that the $3.8 million had been returned in full, that NEAR Intents was stopping its investigation, and that attackers should go through bug bounties next time rather than knock the service offline. Neither post offered a reward.

Two procedures for the same offence

The two cases follow different logics. The Bitget funds were contested property sitting inside NEAR Intents' system, so the service held them and left ownership to a legal process. Its own funds were a loss it had already promised to cover, and their return in full meant that promise cost it nothing.

The vocabulary moved with the logic. Shevchenko described the exploit as a disclosure that could still be made properly within 48 hours, and the return closed the matter on his side. A theft in crypto can still become a disclosure if the money comes back before the deadline.

Banks already run both tracks

The double procedure looks less strange next to a bank's fraud desk. A bank can hold a suspicious incoming payment until a court or the police decide what happens to it, and it can refund its own customer first and chase the money afterwards. NEAR Intents did both within a few days, and announced its rules in public posts where a bank would rely on contracts and regulation.

The order of events is familiar from the rest of fintech: the tools reach users first, and the written rules follow, built from the cases that test them.

Where the written rules already exist

Crypto's legal track has a precedent. Arbitrum's Security Council froze about $71 million in Ether in April 2026 after a bridge exploit, and the funds then reached a New York court, where a judge let a governance vote on moving them go ahead while creditors' claims followed the money, a case we covered in the Arbitrum court ruling.

The deadline track has no equivalent yet. Its terms exist only in the posts of whoever was robbed, and the detailed report NEAR Intents promised on 1 October is where its own version will go on record. Each protocol that publishes its process adds a clause to a rulebook that no regulator has drafted.

Editor's note
Every piece published on The Bright Minded goes through careful verification, but mistakes can happen. If you spot an error, have additional information, or want to flag anything, write to rosalia@thebrightminded.com.