Nomad Bridge Exploit event

security-exploit · PageRank 0.0008

Overview

On 1 August 2022 the Nomad cross-chain bridge lost about $190 million after a contract upgrade left a trusted root set to zero, letting the bridge accept withdrawal messages that had never been proven. The flaw was simple enough to copy, so more than 300 separate addresses replayed the attacker's transaction with their own addresses, draining the bridge over a few hours. It remains one of the largest bridge exploits on record; a key suspect was subsequently arrested in Israel and extradited to the US.

Within the DeFi Intel graph, Nomad Bridge Exploit connects to 1 tracked entity, most strongly to Ethereum.

Relations

Top connections in the DeFi Intel knowledge graph (confidence-weighted, 1 of 1 total).

Frequently asked questions

When did the Nomad exploit happen?

1 August 2022.

How much was lost?

Approximately $190 million in bridged assets.

Was it a single attacker?

No. The initial exploit was quickly copied by hundreds of addresses — over 300 participated — because the attack transaction could be replayed with a different recipient address.