$190 million stolen from Nomad Bridge in ‘Frenzied Free-for-All’ hack

Thieves rushed to drain the bridge as soon as news of the feat surfaced. Unlike most other crypto hacks, stealing funds didn’t require in-depth programming knowledge.

$190 Million Lost in Nomad Attack

Nomad has been targeted in the latest nine-figure crypto attack.

We know the incident with the token Nomad bridge. We are currently investigating and will provide updates when we have them.

— Nomad (⤭⛓🏛) (@nomadxyz_) August 1, 2022

The cross-chain project’s token bridge suffered a major exploit late Monday, allowing a group of thieves to make off with around $190 million in stolen digital assets.

News of the attack first surfaced on social media after security researchers noticed a large amount of property leaving the bridge. According to the Paradigm researcher samczsun, a flaw in Nomad’s Replica contract essentially allowed users to make a small deposit to the bridge and withdraw a much larger amount of funds they never actually owned. While most DeFi exploits are usually performed by experienced developers with in-depth knowledge of Solidity, exploiting this one only required a relatively simple copy and paste exercise. This meant that opportunists flocked to steal money from the bridge as soon as word got out, resulting in what samczsun described as a “frantic free-for-all”.

While the total amount lost has yet to be confirmed, it is estimated that around $190 million worth of wrapped Bitcoin (WBTC), wrapped Ethereum (WETH), USD Coin (USDC) and other assets were stolen. This makes the attack one of the biggest to hit the DeFi space to date. According Defi Llama datathe project now holds only $12,750 in total value locked up.

The Nomad team took to Twitter early Tuesday to say he was “investigating [the incident] and will provide updates” as more information becomes clear, but has yet to release a post-mortem report.

Nomad is one of several cross-chain projects that aim to enable interoperability between blockchains. Its core product is the Nomad token bridge, which allows users to freely move their assets through the Moonbeam parachain of Polkadot, Ethereum, Evmos and Milkomeda. The Nomad team raised $22 million in a seed round from Polychain in April. The increase brought the company’s valuation to $225 million.

Editor’s Note: This story is developing and will be updated as further details become available.

Disclosure: At the time of writing, the author of this piece owned ETH and many other cryptocurrencies.