TRM's Feed Turned Away $50 Million of Bitget's Stolen Money, and Its Counts Just Entered OFAC's Designations
A screener running TRM Labs data refused more than $50 million of Bitget-theft transfers while THORChain moved $6.3 million and told Bitget no. The same firm's counts now sit beside OFAC's newest designations, and a Senate report has put Tether in Washington's sights.
Vincent Jiang · 3 min read
Two rails, one theft
The $387.5 million that left Bitget's hot and warm wallets on 24 September had to cross chains before it could be spent, and the two crossings answered differently 12. NEAR Intents' SHIELD screener, running TRM Labs data alongside AMLBot, PureFi and Binance AML feeds, refused more than $50 million in theft-linked transfer attempts, an estimate its operator gives a 10% error margin, and froze $503,000 mid-swap; about $166,000 slipped through 1.
THORChain moved $6.3 million in ether-to-bitcoin swaps from an attacker wallet and declined Bitget's request to block the addresses, saying it is "permissionless and doesn't censor by design" 1. Bitget CEO Gracy Chen answered that decentralization is "a design principle, not a shield for facilitating known stolen funds" 1. Issuers Circle and Tether froze about $320,000, part of roughly $1.1 million frozen across all responders 12.
The screener turned away nearly eight times what THORChain moved
- Estimate
Data
| Value | |
|---|---|
| SHIELD refused (estimate) | $50M |
| THORChain processed | $6.3M |
| Circle and Tether froze | $0.32M |
The attribution runs through one vendor
On 1 October Bitget confirmed a zero-day in third-party security appliances carried attackers into its wallet job server; it attributes the theft to North Korean actors, on wallet overlaps traced by TRM Labs and Elliptic 2.
On 30 September, OFAC sanctioned ten Tren de Aragua targets and listed seven TRON deposit addresses whose inflows, on TRM Labs' own tally, reached $6.1 million since March 2022 3. Treasury puts the ring's US jackpotting losses at $40.73 million; under E.O. 13224, foreign financial institutions handling significant transactions for designees risk secondary sanctions 3.
The Senate's Iran probe runs on the same counts
Two days earlier, investigators for Senator Richard Blumenthal found that 84% of 846 Iran-sanctioned wallets traded predominantly in USDT 45. He has asked the Treasury and Justice Departments to investigate Tether, which says it froze $550 million of Iran-linked USDT this year 56. The same database decides which transfers a swap service freezes, and its counts sit beside the wallets Treasury lists.
The listed route is Circle
Freezing at the issuer is the layer that reached the money: the $320,000 in USDC and USDT that Circle and Tether froze acted on the asset itself 1. Circle is the only party in that chain on a public market, trading on the NYSE as CRCL 7.
In late September, Binance bought $100 million of Circle's Class A stock and renewed their USDC partnership for five years 7. Analysts still call Tether's liquidity advantage hard to dislodge 8.
E.O. 13224 risk lands on institutions that touch the listed addresses, and the Senate has asked two departments to investigate the biggest issuer 36. The pressure falls on a private company; the same capability sits inside a listed one.
Nobody is named to release the $503,000
NEAR Intents holds the frozen $503,000 pending a legal process that names no release authority and no remedy for a wrongly flagged user, on a screen with a stated 10% error margin; formal claims route through a law-enforcement portal 1.
Two days after publishing those numbers, the service halted its own flows: a bug in its Omni deposit infrastructure cost it $3.8 million, and it promised repayment 9. The first dispute over the half-million it holds will show whether private screening ever returns money under a rule anyone can read.
Deepdive
AI-generated from this story and its cited sources. Not investment advice.
