Nomad Bridge
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·3nfHBg…drS5Summary
Nomad Bridge, operated by Illusory Systems Inc., was a cross-chain asset bridge that suffered a catastrophic $190 million exploit on August 1, 2022, when a routine smart contract upgrade inadvertently initialized trusted Merkle roots to a zero value, rendering all message proofs automatically valid. The vulnerability enabled a widely replicated 'crowd-sourced' draining event involving approximately 300 addresses over roughly 150 minutes — widely regarded as the first 'permissionless' mass-exploitation event in DeFi history. Subsequent actions include a class-action lawsuit, a December 2025 FTC settlement requiring repayment of approximately $37.5 million to affected users, and the 2025 arrest and extradition of a key suspect, Russian-Israeli national Alexander Gurevich.
Connected Entities
1 entities- + 4 more
Timeline(14 events)
10 November 2021
Illusory Systems Inc. incorporated in Delaware; Nomad Bridge protocol development begins under founders Pranay Mohan and James Prestwich.
April 2022
Illusory Systems raises $22.4 million in seed funding led by Polychain Capital, with participation from Circle Ventures, Hack VC, Archetype, Breyer Capital, and others.
June 2022
A routine upgrade to the Nomad Replica.sol smart contract initializes the trusted Merkle root to 0x00, inadvertently making all message proofs automatically valid. The vulnerability goes undetected.
August 2022
An initial attacker discovers the zero-root vulnerability and drains 100 WBTC. Within minutes, approximately 300 addresses begin copying the exploit transaction, substituting their own recipient addresses. Roughly $190 million is drained over approximately 150 minutes in what analysts describe as the first 'crowd-sourced' DeFi exploit.
5 August 2022
Nomad announces a 10% bounty program, offering to refrain from legal action against exploiters who return 90% of stolen funds, plus a Whitehat NFT. CNBC and major outlets report on the offer.
9 August 2022
White-hat participants have returned approximately $32.6 million in tokens to Nomad's recovery address, representing early partial recovery.
February 2023
Class-action lawsuit Singh v. Illusory Systems Inc. filed in the U.S. District Court for the District of Delaware, alleging RICO violations including wire fraud and operating an unlicensed money-transmitting business.
August 2023
FBI's San Francisco field office files an eight-count federal indictment in the Northern District of California against Alexander Gurevich, a Russian-Israeli dual national, alleging wire fraud, conspiracy, and money laundering in connection with the Nomad exploit.
29 March 2024
U.S. District Court dismisses RICO claims in the Singh v. Illusory Systems class-action lawsuit.
December 2024
The United States formally submits an extradition request to Israel for Alexander Gurevich.
19 April 2025
Alexander Gurevich re-enters Israel during Passover holiday and is summoned for an extradition hearing. He ignores the summons and legally changes his name to 'Alexander Block' in Israel's Population Registry.
May 2025
Gurevich applies for a new passport under his changed name and attempts to board a flight to Russia. Israeli police, coordinating with the DOJ, FBI, and Interpol, arrest him at the airport. Israeli authorities approve extradition to the United States.
16 December 2025
The FTC announces a proposed settlement with Illusory Systems Inc. requiring the company to repay approximately $37.5 million to affected users, implement a comprehensive security program, and cease misrepresentations about product security.
19 December 2025
The proposed FTC consent order is published in the Federal Register for public comment, with a comment deadline of January 20, 2026.
Decision Log
- hash: EhszxAJKAX9BXTh2GeDoXjYqNuTaCdwXNvJq1vDDQ3KR
This investigation is cryptographically anchored to the Solana blockchain (1 event). 0 of 21 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/30/2026, 6:25:34 PM
last updated: 8/29/2026, 1:35:21 AM
avoid.net — verified advice for a post-truth world