On August 1, 2022, the Nomad token bridge - a cross-chain messaging protocol connecting Ethereum with chains including Moonbeam and Evmos - was drained of approximately $190M in WETH, USDC, WBTC and other tokens in one of the strangest events in exploit history. The vulnerability was mundane: a routine upgrade had initialized the Replica contract's trusted root to 0x00, the same value that unproven messages default to, so the bridge's process() function accepted withdrawal messages that had never been proven at all. The sociology was not. Because exploiting the bug required nothing more than copying the first attacker's transaction data and substituting one's own address, the initial theft metastasized within minutes into a chaotic public free-for-all: roughly 300 addresses - opportunists, bots, and self-declared white hats alike - raced to drain the bridge before it emptied, in what Blockworks called a "frenzied free-for-all" and CNN described as a chaotic mob attack. White hats later returned more than $22M, and Nomad relaunched with an NFT-based pro-rata claims process, but most of the money was gone. In 2025, Alexander Gurevich - the Russian-Israeli national accused of executing the first exploit transactions and taking about $2.89M - was arrested in Israel and extradited to the United States. Nomad remains the canonical case of an exploit that anyone could join, and of how a one-line initialization error can void an entire security model.
Timeline of events
The seed of the incident was planted before August: in a routine protocol upgrade, Nomad's team initialized the Replica contract's trusted root value to 0x00. On the evening of August 1, 2022 UTC, the first exploit transactions landed, withdrawing tokens from the bridge's Ethereum-side holdings without any corresponding valid cross-chain message. U.S. prosecutors later alleged that Alexander Gurevich identified and executed the initial exploit, taking approximately $2.89M. What happened next had no precedent at this scale: because the exploit transaction was fully visible on-chain and required no crafted proof - only the same calldata with a different recipient address - onlookers began copying it wholesale. Within hours, roughly 300 addresses were draining the bridge in parallel, some running scripted loops, some manually pasting transactions, and some publicly declaring themselves white hats rescuing funds ahead of the mob. The bridge's roughly $190M in locked assets - WETH, USDC, WBTC, and a range of other ERC-20s - was substantially emptied the same night. Nomad acknowledged the exploit, notified law enforcement, and engaged blockchain-analytics firms; within days it published an official recovery address and appealed to white-hat participants to return funds, ultimately recovering more than $22M through that channel. In December 2022 the team prepared the bridge's relaunch alongside a KYC-verified claims process for affected users.
Attack mechanism
Nomad was an optimistic-verification cross-chain messaging system: messages sent from one chain were committed to a Merkle root, relayed, and - after a fraud-proof window - accepted on the destination chain by the Replica contract. Replica maintained the set of confirmed (trusted) roots, and its process() function was required to check that a message had been proven against one of them before executing it. The upgrade broke exactly that check. By initializing the trusted root to 0x00, the upgrade made the zero value - which is also the default status of any message that has never been proven - register as confirmed. The acceptableRoot logic therefore returned true for messages with no proof whatsoever: process() could be called directly on a fabricated message instructing the bridge to release tokens, and the contract would comply. There was no signature to forge, no oracle to manipulate, and no capital required beyond gas. This is also what made the exploit uniquely viral. A typical exploit transaction encodes attacker-specific craft; Nomad's encoded nothing but a fraudulent message whose recipient field anyone could rewrite. Etherscan effectively became the exploit's distribution channel: each successful drain published a working template for the next participant. Security researchers described it as the first decentralized mob robbery of a major protocol - hundreds of independent actors executing the same one-step exploit against a shared pool until it was empty.
Root cause analysis
The root cause was an initialization error in an upgrade, compounded by process failures around it. First, the technical flaw: treating 0x00 as a confirmed root conflated "empty/default" with "valid" - a classic sentinel-value collision. Unproven messages defaulted to the zero root; the upgrade marked the zero root trusted; therefore every unproven message was trusted. Second, the review failure: the change shipped in a routine upgrade, and the semantics of pre-trusting a zero root evidently did not receive adversarial review commensurate with the ~$190M the contract secured. Halborn's post-mortem noted the class of bug was discoverable through comprehensive auditing and standard testing techniques such as fuzzing - a fabricated message with no proof succeeding against process() is precisely the kind of property-violation a test harness should catch. Third, the systemic amplifier: the bridge held its entire locked-asset pool behind a single contract whose validation logic could be voided by one storage value, with no rate limit, withdrawal delay, or circuit breaker between a validation bypass and total drainage. The optimistic-verification design - whose fraud-proof window exists to catch bad messages - provided no protection, because the flaw sat below it: messages were not fraudulently proven, they were never proven at all, and the contract no longer required them to be.
Initial response and recovery
Nomad's response centered on an unusual asset: the ambiguous moral status of its own attackers. Because much of the drain had been executed by opportunists rather than a coordinated criminal operation - some of whom claimed white-hat intent from the start - the team's first move was to publish an official recovery address and publicly promise that good-faith returners would be treated as white hats. The appeal worked in part: more than $22M was returned through the recovery channel. Nomad engaged law enforcement and analytics firms to trace the remainder and announced a 10% bounty framing for returned funds. For users, the team built a claims process operated with CoinList: affected users completed KYC verification and received a non-transferable NFT representing their loss, redeemable for a pro-rata share of recovered funds on Ethereum - with the NFT also entitling holders to proportional distributions from any future recoveries, including law-enforcement seizures. The bridge itself was rebuilt and prepared for relaunch by December 2022. The recovery outcome was nonetheless partial by any measure: against roughly $190M drained, the returned-plus-recovered pool left most losses outstanding, and Nomad never regained its pre-hack position in the bridge market.
Funds tracking and laundering
Tracking the Nomad funds presented an unusual forensic problem: instead of one attacker cluster, investigators faced roughly 300 independent recipient addresses spanning a spectrum from provable white hats (who returned funds intact) to opportunists who kept small takes, to serious launderers who processed their shares professionally. Analytics firms including TRM Labs traced the major flows as they fragmented across chains. The best-documented laundering thread is the one attached to the alleged initiator: according to U.S. Department of Justice filings described by TRM Labs, Alexander Gurevich received stolen assets within hours of the breach and moved his portion through Tornado Cash, converted funds toward privacy coins including Monero, and routed proceeds through offshore structures. The mass-participation structure also produced an enforcement dynamic no prior bridge hack had: many participants were identifiable retail users who had exploited the bridge from KYC-linked addresses, and a meaningful share of the $22M+ in returns is attributable to participants concluding - correctly - that keeping the funds meant keeping criminal liability. The publicly-visible, copy-paste nature of the theft thus cut both ways: it multiplied the thieves, but it also left an unusually rich evidentiary record connecting drains to real-world identities.
Legal and regulatory aftermath
The Nomad case produced one of the few flesh-and-blood defendants in major bridge-exploit history. U.S. federal prosecutors filed an eight-count indictment against Alexander Gurevich in August 2023, on charges including wire fraud, money laundering and transportation of stolen property, with the most serious counts carrying up to 20 years. The U.S. formally requested extradition from Israel in December 2024. On May 1, 2025, Israeli police arrested Gurevich at Ben-Gurion Airport as he attempted to board a flight to Russia - traveling under a passport in the name "Alexander Block," a legal name change he had made only a day earlier. Israeli authorities approved his extradition in May 2025, and he was subsequently extradited to the United States, in a case coordinated among the DOJ, FBI, Interpol and Israeli police. The prosecution is significant beyond Nomad: it demonstrated that a copy-paste exploit's "first mover" can be individually identified, charged and extradited even years later, and that participation in a mob drain - however diffuse - creates individually traceable liability. The case proceeded alongside broader U.S. enforcement attention to the 2022 bridge-hack wave, though unlike Ronin or Harmony, Nomad carried no state-actor attribution and was handled as conventional financial crime.
Industry implications
Nomad closed out the catastrophic 2022 bridge-exploit sequence - Wormhole ($326M) in February, Ronin ($620M) in March, Harmony in June, Nomad in August, BNB Chain's Token Hub in October - and contributed distinct lessons to it. First, upgrade risk became a first-class category: Wormhole and Ronin were key-management and verification failures, but Nomad was introduced by the protocol's own routine upgrade, and post-2022 security practice responded with upgrade-specific audits, storage-initialization review, and invariant test suites run against every deployment rather than every release. Second, the copy-paste dynamic reframed exploit game theory: protocols learned that a sufficiently simple vulnerability will be exploited by the crowd, not just the discoverer, collapsing the response window from hours to minutes and strengthening the argument for automatic circuit breakers, rate limits and withdrawal delays on bridge contracts. Third, the white-hat amnesty playbook - public recovery address, no-questions framing for good-faith returns, bounty percentage for the rest - was validated at scale by the $22M+ returned and has been reused in subsequent incidents. Fourth, the Gurevich prosecution established that mob-exploit participants and initiators alike are reachable: the combination of on-chain evidence, KYC chokepoints and extradition treaties turned what looked like anonymous opportunism into one of the more legible criminal evidence sets in DeFi history.
Verdict and lessons
The Nomad exploit is the purest demonstration in the record that a protocol's security model is only as strong as its most recent storage write. Nomad's optimistic-verification design, its fraud-proof window, its audited message-passing architecture - all of it was voided by a single initialization value that made "never proven" equal to "trusted." The technical lessons are concrete: sentinel values must never collide with valid states; zero/default values deserve explicit adversarial attention in every upgrade review; storage initialization is code and must be audited as such; and invariant testing ("no message processes without a valid proof") catches this class of bug mechanically. The architectural lessons match the rest of the 2022 bridge cohort: pooled bridge liquidity behind a single validation gate needs rate limits, delays and circuit breakers, because the difference between a $2.89M incident and a $190M incident at Nomad was nothing more than the hours the contract stood open while the crowd copied the first thief. And the sociological lesson is Nomad's alone: given a riskless-looking, one-step, publicly-visible exploit, hundreds of ordinary actors will join a theft in progress - and a meaningful fraction will regret it when the on-chain record meets KYC data and extradition law, as the returned $22M+ and the Gurevich prosecution both attest. Security models must assume the adversary is everyone.
Root cause
A routine upgrade initialized the Replica contract's trusted root to 0x00, the same value unproven messages default to, so process() accepted messages that had never been proven against any valid root. Fabricated withdrawal messages executed without proofs, signatures or capital, and because each exploit transaction was a reusable template - copy the calldata, swap the recipient - roughly 300 addresses drained ~$190M within hours. The bug class was discoverable via audit and fuzz testing; no rate limit or circuit breaker stood between the validation bypass and the full pool.
Recovery and aftermath
White-hat and remorseful participants returned more than $22M to Nomad's official recovery address. Nomad rebuilt the bridge for a December 2022 relaunch and, with CoinList, ran a KYC claims process issuing non-transferable NFTs redeemable for pro-rata shares of recovered funds, including future recoveries. Alexander Gurevich, accused of the initial ~$2.89M exploit, was indicted in the U.S. (August 2023), arrested at Ben-Gurion Airport on May 1, 2025 while fleeing to Russia under a freshly changed name, and extradited to the United States. Most of the $190M remains unrecovered.
Lessons
- Sentinel/default values must never collide with valid states - a zero root marked trusted made every unproven message valid
- Storage initialization in upgrades is security-critical code and needs the same adversarial review and invariant testing as core logic
- Bridges need rate limits, withdrawal delays and circuit breakers; a copy-pasteable exploit collapses the response window to minutes
- Public white-hat amnesty with an official recovery address demonstrably recovers funds - and on-chain evidence plus KYC chokepoints make even mob-exploit participants individually accountable
Precedent
Defined the mob-exploit category - the first major protocol drained by hundreds of independent copy-paste participants - and produced one of the first arrest-and-extradition outcomes for a major bridge exploit (Alexander Gurevich, extradited to the U.S. in 2025), proving individual accountability is reachable even in crowd-sourced thefts.