Introduction: Blocking a $50 Million Escape
In the aftermath of the September 24 Bitget hack, which saw over $387 million stolen, the crypto community prepared for another major loss. This time, however, NEAR Intents’ SHIELD risk engine intervened at a critical moment. As attackers attempted to move more than $50 million in stolen funds across chains, SHIELD detected the flows and blocked a significant portion in real time. Instead of simply tracking the aftermath, this intervention provided a working example of how on-chain defenses can actively disrupt illicit transfers as they happen.
SHIELD identified suspicious activity as the attackers routed assets through NEAR Intents. Approximately $166,000 managed to pass through, while about $503,000 was frozen mid-transaction and held for legal and recovery proceedings. Although these amounts are small compared to the total stolen, the real significance lies in the mechanism: the ability to intervene during the transaction process, not just after the fact. This marks a shift in how cross-chain security can be approached.
Inside the SHIELD Risk Engine
The SHIELD engine functions as a risk detection layer within the NEAR Intents routing system. Rather than processing every request without scrutiny, SHIELD continuously analyzes transaction flows for indicators of illicit activity. When a transaction is flagged, it can be delayed, frozen, or redirected for further review, all while preserving the permissionless nature of public blockchains. This approach allows for swift action without introducing centralized control points.
During the Bitget incident, SHIELD’s intervention was immediate. Some funds slipped through, but a substantial amount was stopped before reaching its destination. This real-time capability shows that risk management can be built directly into the infrastructure that powers cross-chain transfers, making security an integral part of the process instead of a separate or after-the-fact concern.
Lessons for Cross-Chain Security
The Bitget exploit and NEAR Intents’ response highlight a growing challenge in crypto: attackers increasingly use cross-chain protocols and bridges to move and launder stolen assets. Traditional methods, such as tracking funds after they have moved, often leave victims with limited recourse. The NEAR Intents case demonstrates that embedded, proactive detection can disrupt these flows and provide new options for intervention.
Bitget CEO Gracy Chen pointed out that public blockchains do not have to choose between openness and security. She emphasized that risk-detection mechanisms can be implemented without compromising permissionless access. For projects and users, this signals a shift toward adaptive security protocols that respond to threats as they emerge, rather than relying solely on post-incident recovery.
Setting a New Standard for Risk Management
NEAR Intents’ handling of the Bitget hack stands out not just for the funds intercepted, but for the precedent it establishes. By waiving its share of the recovery bounty, NEAR Intents prioritized returning assets to victims, reinforcing trust in the system. This approach suggests that protocols embedding risk management and supporting recovery efforts may set a new expectation for cross-chain services.
As cross-chain attacks become more complex, tools like SHIELD may shift from being innovative features to essential infrastructure. The ability to freeze, investigate, and coordinate responses in real time will likely shape the reputation and resilience of routers, bridges, and liquidity platforms. For those moving significant value across ecosystems, the security features of routing protocols are becoming as important as speed or cost efficiency.
Looking Ahead: The Role of Real-Time Security
The NEAR Intents response to the Bitget hack demonstrates that on-chain infrastructure can deliver active, embedded security. As new attacks test the limits of traditional monitoring and recovery, protocols with integrated real-time risk engines may be better equipped to protect users and preserve confidence in cross-chain transactions.
For anyone navigating cross-chain DeFi, assessing the security of your transaction routes is more important than ever. To compare cross-chain routes and find the most efficient and secure onchain options, visit the Chainspot router.
