Nomad Bridge
Last changed 2026-10-10 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 8 → 47. Problems weighed by who is responsible: incidents the subject suffered −12.8, the subject's own conduct −8, concerns that are not fraud −3.2, problems around the subject, caused by others −1.6; legitimacy credit long-running +8. Version history →
Why this score
| Every page starts at | 65 |
| The subject's own conduct | -8 |
| Concerns that are not fraud | -3.2 |
| Incidents it suffered (e.g. hacks) | -12.8 |
| Problems around it, caused by others | -1.6 |
| Long-running | +8 |
| Sum | 47 |
Score: 47/100 (kept between 0 and 100)
How scoring works →Summary
Nomad Bridge, operated by Illusory Systems Inc., was a cross-chain asset bridge that suffered a catastrophic $190 million exploit on August 1, 2022, when a routine smart contract upgrade inadvertently initialized trusted Merkle roots to a zero value, rendering all message proofs automatically valid. The vulnerability enabled a widely replicated 'crowd-sourced' draining event involving approximately 300 addresses over roughly 150 minutes — widely regarded as the first 'permissionless' mass-exploitation event in DeFi history. Subsequent actions include a class-action lawsuit, a December 2025 FTC settlement requiring repayment of approximately $37.5 million to affected users, and the 2025 arrest and extradition of a key suspect, Russian-Israeli national Alexander Gurevich.
Connected Entities
8 entities · 60 linked investigations- Ronin Bridge→mentioned with→Ethereum(80%)
- Nomad Bridge→mentioned with→Uniswap(60%)
- Nomad Bridge→mentioned with→Ethereum(70%)
- Nomad Bridge→mentioned with→Monero(60%)
- Uniswap→mentioned with→Ethereum(80%)
- Nomad Bridge→mentioned with→Ronin Bridge(80%)
- Nomad Bridge→mentioned with→Rari Capital(80%)
- Nomad Bridge→mentioned with→North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign(80%)
- Nomad Bridge→mentioned with→Wormhole Bridge(80%)
- North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign→mentioned with→Ronin Bridge(80%)
- + 6 more
Timeline(14 events)
10 November 2021
Illusory Systems Inc. incorporated in Delaware; Nomad Bridge protocol development begins under founders Pranay Mohan and James Prestwich.
April 2022
Illusory Systems raises $22.4 million in seed funding led by Polychain Capital, with participation from Circle Ventures, Hack VC, Archetype, Breyer Capital, and others.
June 2022
A routine upgrade to the Nomad Replica.sol smart contract initializes the trusted Merkle root to 0x00, inadvertently making all message proofs automatically valid. The vulnerability goes undetected.
August 2022
An initial attacker discovers the zero-root vulnerability and drains 100 WBTC. Within minutes, approximately 300 addresses begin copying the exploit transaction, substituting their own recipient addresses. Roughly $190 million is drained over approximately 150 minutes in what analysts describe as the first 'crowd-sourced' DeFi exploit.
5 August 2022
Nomad announces a 10% bounty program, offering to refrain from legal action against exploiters who return 90% of stolen funds, plus a Whitehat NFT. CNBC and major outlets report on the offer.
9 August 2022
White-hat participants have returned approximately $32.6 million in tokens to Nomad's recovery address, representing early partial recovery.
February 2023
Class-action lawsuit Singh v. Illusory Systems Inc. filed in the U.S. District Court for the District of Delaware, alleging RICO violations including wire fraud and operating an unlicensed money-transmitting business.
August 2023
FBI's San Francisco field office files an eight-count federal indictment in the Northern District of California against Alexander Gurevich, a Russian-Israeli dual national, alleging wire fraud, conspiracy, and money laundering in connection with the Nomad exploit.
29 March 2024
U.S. District Court dismisses RICO claims in the Singh v. Illusory Systems class-action lawsuit.
December 2024
The United States formally submits an extradition request to Israel for Alexander Gurevich.
19 April 2025
Alexander Gurevich re-enters Israel during Passover holiday and is summoned for an extradition hearing. He ignores the summons and legally changes his name to 'Alexander Block' in Israel's Population Registry.
May 2025
Gurevich applies for a new passport under his changed name and attempts to board a flight to Russia. Israeli police, coordinating with the DOJ, FBI, and Interpol, arrest him at the airport. Israeli authorities approve extradition to the United States.
16 December 2025
The FTC announces a proposed settlement with Illusory Systems Inc. requiring the company to repay approximately $37.5 million to affected users, implement a comprehensive security program, and cease misrepresentations about product security.
19 December 2025
The proposed FTC consent order is published in the Federal Register for public comment, with a comment deadline of January 20, 2026.
Decision Log
- slot 455358449 · hash 8p9yP9Acr53b4ksm2asuZBLGvGiAN238h8BW69Vx3bY6
- slot 423210460 · hash EhszxAJKAX9BXTh2GeDoXjYqNuTaCdwXNvJq1vDDQ3KR
This investigation is cryptographically anchored to the Solana blockchain (2 decisions). 19 of 21 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/30/2026, 6:25:34 PM
last updated: 10/10/2026, 6:40:13 PM
9 viewsavoid.net — verified advice for a post-truth world