Skip to main content
Sign in

Nomad Bridge

avoid.net/nomad-bridge8/100·92% conf.
[AI-DRAFTED · AWAITING VERIFICATION]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·3nfHBg…drS5

Summary

Nomad Bridge, operated by Illusory Systems Inc., was a cross-chain asset bridge that suffered a catastrophic $190 million exploit on August 1, 2022, when a routine smart contract upgrade inadvertently initialized trusted Merkle roots to a zero value, rendering all message proofs automatically valid. The vulnerability enabled a widely replicated 'crowd-sourced' draining event involving approximately 300 addresses over roughly 150 minutes — widely regarded as the first 'permissionless' mass-exploitation event in DeFi history. Subsequent actions include a class-action lawsuit, a December 2025 FTC settlement requiring repayment of approximately $37.5 million to affected users, and the 2025 arrest and extradition of a key suspect, Russian-Israeli national Alexander Gurevich.

Connected Entities

1 entities
Organizations
Nomad Bridge
Relationships
  • + 4 more
Have evidence about Nomad Bridge?

Timeline(14 events)

10 November 2021

Illusory Systems Inc. incorporated in Delaware; Nomad Bridge protocol development begins under founders Pranay Mohan and James Prestwich.

April 2022

Illusory Systems raises $22.4 million in seed funding led by Polychain Capital, with participation from Circle Ventures, Hack VC, Archetype, Breyer Capital, and others.

June 2022

A routine upgrade to the Nomad Replica.sol smart contract initializes the trusted Merkle root to 0x00, inadvertently making all message proofs automatically valid. The vulnerability goes undetected.

August 2022

An initial attacker discovers the zero-root vulnerability and drains 100 WBTC. Within minutes, approximately 300 addresses begin copying the exploit transaction, substituting their own recipient addresses. Roughly $190 million is drained over approximately 150 minutes in what analysts describe as the first 'crowd-sourced' DeFi exploit.

5 August 2022

Nomad announces a 10% bounty program, offering to refrain from legal action against exploiters who return 90% of stolen funds, plus a Whitehat NFT. CNBC and major outlets report on the offer.

9 August 2022

White-hat participants have returned approximately $32.6 million in tokens to Nomad's recovery address, representing early partial recovery.

February 2023

Class-action lawsuit Singh v. Illusory Systems Inc. filed in the U.S. District Court for the District of Delaware, alleging RICO violations including wire fraud and operating an unlicensed money-transmitting business.

August 2023

FBI's San Francisco field office files an eight-count federal indictment in the Northern District of California against Alexander Gurevich, a Russian-Israeli dual national, alleging wire fraud, conspiracy, and money laundering in connection with the Nomad exploit.

29 March 2024

U.S. District Court dismisses RICO claims in the Singh v. Illusory Systems class-action lawsuit.

December 2024

The United States formally submits an extradition request to Israel for Alexander Gurevich.

19 April 2025

Alexander Gurevich re-enters Israel during Passover holiday and is summoned for an extradition hearing. He ignores the summons and legally changes his name to 'Alexander Block' in Israel's Population Registry.

May 2025

Gurevich applies for a new passport under his changed name and attempts to board a flight to Russia. Israeli police, coordinating with the DOJ, FBI, and Interpol, arrest him at the airport. Israeli authorities approve extradition to the United States.

16 December 2025

The FTC announces a proposed settlement with Illusory Systems Inc. requiring the company to repay approximately $37.5 million to affected users, implement a comprehensive security program, and cease misrepresentations about product security.

19 December 2025

The proposed FTC consent order is published in the Federal Register for public comment, with a comment deadline of January 20, 2026.

Provenance & Audit Trail

Decision Log

This investigation is cryptographically anchored to the Solana blockchain (1 event). 0 of 21 cited source URLs have an Internet Archive snapshot.

model: claude-sonnet-4-6

generated: 5/30/2026, 6:25:34 PM

last updated: 8/29/2026, 1:35:21 AM

avoid.net — verified advice for a post-truth world