Ornella Hernandez

<div id="highlights-block_62ec4dc44dae4" class="highlights">
 <ul>
 <li>Nomad is considering a 10% bounty for hackers who return most of their stolen funds</li>
 <li>The largest return to date has been 100 ETH ($160,000)</li>
 </ul>
 
</div>



Token bridge <a href="https://cms.blockworks.co/nomad-token-bridge-raided-for-190m-in-frenzied-free-for-all/" target="_blank" rel="noreferrer noopener">Nomad suffered a hack</a> on Monday that resulted in a loss of $190 million in cryptocurrencies. So far, $19.4 million of those funds have been sent <a href="https://etherscan.io/address/0x94A84433101A10aEda762968f6995c574D1bF154" target="_blank" rel="noreferrer noopener">back</a> to the protocol.



Nomad <a href="https://twitter.com/nomadxyz_/status/1554679735006859264?s=20&amp;t=-HOi7igUyKVFpMpTgHB0wg" target="_blank" rel="noreferrer noopener">created a recovery wallet address</a> in a plea to the “white hat hackers and ethical researcher friends who have been safeguarding ETH/ERC-20 tokens” to return the lost digital assets.



The wallet was set up in association with custodian bank Anchorage Digital. Nomad has since taken to Twitter to thank some of its contributors.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Thank you to &#8211; 🍉🍉🍉.eth ($4m) &#8211; 0xE3F40743cc18fd45D475fAe149ce3ECC40aF68c3 ($3.4m) &#8211; darkfi.eth ($1.9m) &#8211; returner-of-beans.eth ($1m) &#8211; anime.eth ($900k) for returning a total of $11.2m to our recovery address! We’ve recovered a total of $16.6m so far.&mdash; Nomad (⤭⛓🏛) (@nomadxyz_) <a href="https://twitter.com/nomadxyz_/status/1555045760588140544?ref_src=twsrc%5Etfw">August 4, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Nomad’s hack <a href="https://cms.blockworks.co/after-latest-crypto-bridge-hack-industry-participants-call-for-tightened-security/" target="_blank" rel="noreferrer noopener">resulted</a> from an issue in the code itself, 1KX Research told Blockworks. Nomad developers had accidentally enabled a code setting which automatically verified any transaction script sent to the protocol, as long as they had a default “root” of “0x00.”



The result was a free-for-all involving onlookers rushing to submit illicit transactions, quickly draining the token bridge of all user funds kept inside its associated smart contract.



Nomad has <a href="https://twitter.com/nomadxyz_/status/1555191925841563648?s=20&amp;t=-HOi7igUyKVFpMpTgHB0wg" target="_blank" rel="noreferrer noopener">acknowledged</a> that some users wanted “more consistent communications” and apologized for not having “provided that up to this point.”



The firm <a href="https://twitter.com/nomadxyz_/status/1555293965049630722?s=20&amp;t=-HOi7igUyKVFpMpTgHB0wg" target="_blank" rel="noreferrer noopener">announced</a> via Twitter that hackers who return at least 90% of the total funds they hacked may be considered for a bounty of up to 10%. 



This incident is the <a href="https://cms.blockworks.co/the-nine-largest-crypto-hacks-in-2022/" target="_blank" rel="noreferrer noopener">third-biggest cryptocurrency hack this year</a> after the Solana-to-Ethereum <a href="https://cms.blockworks.co/in-second-largest-defi-hack-ever-blockchain-bridge-loses-320m-ether/" target="_blank" rel="noreferrer noopener">Wormhole bridge</a> and the <a href="https://cms.blockworks.co/sky-mavis-ronin-network-bridge-exploited-for-over-600m/" target="_blank" rel="noreferrer noopener">Axie Infinity Ronin bridge exploits</a>, which lost $325 million and $625 million, respectively, valued at the time of the exploits.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

hack

Nomad Recovers Nearly $20M of Stolen $190M

David Canellis

<div id="highlights-block_62e907e74b5d3" class="highlights">
 <ul>
 <li>The Nomad incident is the third-biggest cryptocurrency hack of the year, behind Wormhole and Ronin</li>
 <li>Around 41 addresses siphoned cryptocurrency from the protocol</li>
 </ul>
 
</div>



Token bridge Nomad has suffered a “frenzied free-for-all” after attackers raided the protocol for more than $190 million in cryptocurrency.



Nomad, which marketed itself as a “security-first” platform for sending ERC-20 tokens between compatible blockchains, confirmed the raid in a Tuesday morning tweet.



&#8220;Nomad identified an attack on its token bridge on August 1 at approximately 5:32 PM Eastern Time (ET),&#8221; the company said in a statement emailed to Blockworks. &#8220;An investigation is ongoing and leading firms for blockchain intelligence and forensics have been retained. Nomad has notified law enforcement and is working around the clock to address the situation and provide timely updates.&#8221;



The incident differs from other large-scale hacks to cripple token bridges this year. Token bridges enable crypto users to port digital assets over networks by first locking them inside a smart contract.&nbsp;



The bridge then issues a derivative token, a “wrapped asset,” on the other side, with their values backed by their original deposits. Nomad supports Ethereum, Avalanche, Evmos and Moonbeam.



February’s Wormhole hack saw attackers exploit buggy smart contract code to mint themselves $320 million in Wrapped Ether without posting the required collateral.&nbsp;



The Axie Infinite Ronin bridge attack, disclosed in March, involved a months-long phishing campaign to acquire private keys associated with its multisig wallet, which resulted in some $625 million in crypto stolen (both incidents valued at the time of the attack).



But Sam Sun, head of security at digital asset investment firm Paradigm, explained in a Twitter thread that Nomad’s thieves didn’t need to know anything about the Ethereum programming language Solidity to make off with user collateral.



<h3 class="wp-block-heading">Rari Capital hacker returned to raid Nomad</h3>



Nomad’s developers had accidentally pushed a routine upgrade which told the protocol to process any transaction with the default root hash of “0x00,” where usually blockchain networks require a unique and specific root as proof that the transaction is valid.



This meant Nomad would effectively approve any transaction submitted to the protocol. After an attacker realized and initiated large illicit transfers, other users simply copy-pasted their transaction script and replaced the receiver address with their own, explained Victor Young, chief architect at interoperability network Analog.



To Young, a key advantage of smart contract platforms, like the ones powering Nomad, is that they are Turing-complete systems. They can compute &#8220;virtually everything a modern digital computer can do from a mathematical standpoint,&#8221; Young said.



&#8220;Unfortunately, this introduces countless and unknown attack vectors that open the smart contract to hacks,&#8221; Young told Blockworks. &#8220;When you combine this with lax developers that fail to implement a robust set of testing mechanisms, you get the ridiculous meltdown that we are currently witnessing.”



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Nomad exploit onchain activity, visualized. <a href="https://t.co/WqjcbQfWKW">pic.twitter.com/WqjcbQfWKW</a>&mdash; Hsaka (@HsakaTrades) <a href="https://twitter.com/HsakaTrades/status/1554254701994156033?ref_src=twsrc%5Etfw">August 1, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Young prescribed other blockchain platforms end-to-end tests and repeated code audits to help mitigate risk of this happening elsewhere.



Blockchain security firm PeckShield <a href="https://twitter.com/PeckShieldAlert/status/1554350737957998592" target="_blank" rel="noreferrer noopener">reported</a> around 41 addresses had raided Nomad, a mixture of Wrapped Bitcoin and Wrapped Ether alongside stablecoins DAI and USDC.&nbsp;



Notably, the same address associated with the Rari Capital <a href="https://cms.blockworks.co/hacked-crypto-platform-offers-no-questions-asked-10m-bounty-for-stolen-funds/" target="_blank" rel="noreferrer noopener">hack</a> in late-April was said to have pilfered $3.4 million in cryptocurrency. Less than $12,000 remains in Nomad’s smart contracts, down from more than $190 million before the raid, per <a href="https://defillama.com/protocol/nomad" target="_blank" rel="noreferrer noopener">DeFi Llama</a>.&nbsp;



The Nomad incident is now the third-biggest hack of the year, behind Wormhole and Ronin. It’s unclear what’s next for the firm.&nbsp;



Both Wormhole and the Axie Infinite teams raised venture capital in a bid to make both their users and protocols whole following their respective hacks. The company told Blockworks that its goal is to identify the accounts involved and ultimately trace and recover crypto.



Nomad also said that &#8220;many white hat [hacker] friends&#8221; had reacted quickly to withdraw and safeguard some of the funds, and directed its community to follow its Twitter account for instructions on how to return the stolen money.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Nomad Bridge Funds Recovery Process Dear white hat hackers and ethical researcher friends who have been safeguarding ETH/ERC-20 tokens, Please send the funds to the following wallet address on Ethereum: 0x94A84433101A10aEda762968f6995c574D1bF154 <a href="https://t.co/UF623JSZ8u">pic.twitter.com/UF623JSZ8u</a>&mdash; Nomad (⤭⛓🏛) (@nomadxyz_) <a href="https://twitter.com/nomadxyz_/status/1554679735006859264?ref_src=twsrc%5Etfw">August 3, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



This article was updated at 4:09 am ET, August 3, to include Nomad&#8217;s statement.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>