Attackers behind the $387.5 million Bitget hack tried to launder more than $50 million through Near Intents, but the protocol's SHIELD security system stopped most of it. Only $166,000 made it through. Another $503,000 was frozen mid-execution.
Alex Shevchenko, co-founder of Aurora, said the protocol will waive its recovery bounty, a move that drew praise from the crypto community.
How the attack unfolded
After pulling off the $387.5 million heist from Bitget, the attackers needed a way to move the funds without getting caught. They turned to Near Intents, a cross-chain protocol that lets users swap assets across different blockchains. The plan was to push over $50 million through the service in a series of transfers.
That's when SHIELD, Near Intents' security layer, stepped in. The system flagged the activity as suspicious and blocked the bulk of the transactions. By the time the dust settled, only $166,000 had successfully slipped through. Another $503,000 got frozen mid-execution, meaning the attackers couldn't complete those transfers either.
The exact mechanics of how SHIELD detected the suspicious activity aren't public, but the result is clear: the vast majority of the attempted transfers never made it.
The bounty waiver
Alex Shevchenko, co-founder of Aurora, said the protocol will waive its recovery bounty — the fee it would normally take for helping recover stolen funds. That decision means Near Intents won't pocket a cut of the recovered money, leaving more for Bitget or the affected users.
The waiver drew praise. In an industry where recovery efforts often come with strings attached, giving up a bounty is unusual. Shevchenko's statement didn't include a specific reason, but the move signals that the protocol is prioritizing goodwill over profit in this case.
Bitget is still on the hook for the full $387.5 million hack. The $50 million that Near Intents blocked is a fraction of that, but it's a meaningful recovery. The exchange hasn't said how it plans to cover the remaining losses or whether users will be reimbursed.
The $166,000 that escaped is a rounding error compared to the overall haul, but it shows that even with strong security, not every transaction can be stopped. The $503,000 frozen mid-execution could eventually be returned, depending on how the investigation plays out.
Near Intents hasn't commented on what happens next with the frozen funds or whether it will coordinate with Bitget on returning them.
Cross-chain bridges and intent-based protocols have become prime targets for hackers looking to move stolen assets. Near Intents' SHIELD system worked as intended here, but the fact that $166,000 got through shows there's no such thing as a perfect defense.
The crypto industry has seen a string of high-profile hacks this year, and recovery efforts are often slow and incomplete. This case is different because a third-party protocol — not the exchange itself — caught the suspicious activity and acted on it.
Whether other protocols will follow Near Intents' lead in waiving recovery bounties is an open question. For now, the focus is on Bitget and how it handles the fallout from the $387.5 million hack.
Bitget hasn't set a timeline for reimbursing users or announced any new security measures. The exchange is expected to provide more details in the coming weeks.
