Audit log

Every state-changing event for Nomad: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-20 18:59:01Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 421,044,890

   sig

   4Xv6AZtx2MQQ…vN6G3vZycopyexplorer ↗

   hash

   zgXww9yWKjEo…S6SfGJnLcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (8448 B) ▸

   {"actor":"system:backfill","investigation_id":"f9e685c5-2870-4b10-914f-b599ddbdbd9c","kind":"publish","page_slug":"nomad","published_at":"2026-05-20T18:59:01.928Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Nomad","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.classaction.org/news/nomad-crypto-bridge-class-action-says-simple-programmer-mistake-allowed-186m-hack-in-2022"},{"credibility":3,"name":"","type":"other","url":"https://www.zellic.io/blog/audit-drift/"},{"credibility":3,"name":"","type":"other","url":"https://medium.com/nomad-xyz-blog/nomad-bridge-hack-root-cause-analysis-875ad2e5aacd"},{"credibility":3,"name":"","type":"other","url":"https://www.crunchbase.com/organization/illusory-systems-inc"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/160851/nomads-190-million-bridge-exploit-drew-hacking-feeding-frenzy-of-300-addresses"},{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/tech/2022/08/11/copycats-stole-88m-during-nomad-exploit-by-copying-attackers-code-coinbase"},{"credibility":3,"name":"","type":"other","url":"https://techcrunch.com/2022/08/02/nomad-chaotic-exploit-crypto/"},{"credibility":3,"name":"","type":"other","url":"https://edition.cnn.com/2022/08/03/tech/crypto-bridge-hack-nomad"},{"credibility":3,"name":"","type":"other","url":"https://medium.com/immunefi/hack-analysis-nomad-bridge-august-2022-5aa63d53814a"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-nomad-hack-august-2022"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://cloud.google.com/blog/topics/threat-intelligence/dissecting-nomad-bridge-hack"},{"credibility":3,"name":"","type":"other","url":"https://www.trmlabs.com/resources/blog/key-suspect-in-190m-nomad-bridge-exploit-extradited-to-the-united-states"},{"credibility":3,"name":"","type":"other","url":"https://www.coinbase.com/es-es/blog/nomad-bridge-incident-analysis"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.cnbc.com/2022/08/05/crypto-startup-nomad-offers-10percent-bounty-after-190-million-hack.html"},{"credibility":3,"name":"","type":"other","url":"https://cryptonews.com/news/over-usd-36m-returned-nomad-bridges-fund-recovery-address.htm"},{"credibility":3,"name":"","type":"other","url":"https://blockchain.bakermckenzie.com/2024/04/08/u-s-court-dismisses-rico-lawsuit-brought-in-connection-with-nomad-bridge-hack/"},{"credibility":3,"name":"","type":"other","url":"https://www.theregister.com/2025/12/17/nomad_ftc_settlement/"},{"credibility":3,"name":"","type":"other","url":"https://www.insideprivacy.com/united-states/federal-trade-commission/ftc-announces-10-year-information-security-consent-orders-with-illuminate-education-and-illusory-systems/"},{"credibility":3,"name":"","type":"other","url":"https://www.federalregister.gov/documents/2025/12/19/2025-23407/illusory-systems-inc-analysis-of-proposed-consent-order-to-aid-public-comment"},{"credibility":3,"name":"","type":"other","url":"https://www.bleepingcomputer.com/news/legal/israel-arrests-new-suspect-behind-nomad-bridge-190m-crypto-hack/"},{"credibility":3,"name":"","type":"other","url":"https://www.dlnews.com/articles/defi/hacker-behind-190m-nomad-bridge-exploit-arrested-in-israel/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.ftc.gov/news-events/news/press-releases/2025/12/ftc-will-require-illusory-systems-return-money-stolen-hackers-implement-information-security-program"},{"credibility":3,"name":"","type":"other","url":"https://medium.com/coinmonks/nomad-bridge-two-years-after-hack-dead-in-the-water-7235bb2d68ba"},{"credibility":3,"name":"","type":"other","url":"https://caselaw.findlaw.com/court/us-dis-crt-d-del/116009637.html"},{"credibility":3,"name":"","type":"other","url":"https://www.zellic.io/blog/audit-drift/"}]}],"sources_used":[],"summary":"Nomad was a cross-chain messaging bridge operated by Illusory Systems, Inc. that suffered one of the largest DeFi exploits in history on August 1–2, 2022, when a smart contract initialization bug allowed approximately $190 million in user funds to be drained in a chaotic free-for-all involving over 300 wallet addresses. The protocol never recovered meaningful user adoption after a December 2022 relaunch, faced a class action lawsuit and an FTC enforcement action, and in December 2025 agreed to a settlement requiring repayment of $37.5 million to affected users.","timeline":[{"date":"2021-11-10","event":"Illusory Systems, Inc. incorporated in Delaware by Pranay Mohan, James Prestwich, and Austin Liau.","source":""},{"date":"2022-05-01","event":"Quantstamp begins security audit of Nomad's smart contract system.","source":""},{"date":"2022-06-09","event":"Quantstamp delivers final audit report identifying 40 issues, including input validation edge cases. Audit team notes the Nomad team misunderstood at least one flagged issue.","source":""},{"date":"2022-06-21","event":"Nomad deploys a routine upgrade to its Replica smart contract that initializes the trusted Merkle root to 0x00, introducing the critical vulnerability. The deployed code differs from the audited version.","source":""},{"date":"2022-08-01","event":"An initial attacker discovers the zero-root initialization bug and begins draining funds from the Nomad bridge by calling the process() function with a zero root and modified recipient addresses.","source":""},{"date":"2022-08-02","event":"Over 300 wallet addresses join the exploit after the initial attacker's transaction calldata becomes visible on-chain. Approximately $190 million in user funds are drained in a chaotic free-for-all. CNN Business, TechCrunch, and CoinDesk report the event contemporaneously.","source":""},{"date":"2022-08-05","event":"Nomad announces a 10 percent bounty program, offering legal immunity and fund retention for any attacker returning at least 90 percent of drained assets.","source":""},{"date":"2022-08-11","event":"Coinbase publishes incident analysis estimating 88 percent of participating addresses were copycats; copycats collectively stole approximately $88 million.","source":""},{"date":"2022-08-20","event":"Over $36 million returned to Nomad's recovery address by more than 40 participating wallets — approximately 19 percent of total stolen funds.","source":""},{"date":"2022-12-01","event":"Nomad relaunches bridge to allow users to withdraw remaining bridged assets. The relaunch attracts negligible user activity and TVL.","source":""},{"date":"2023-01-01","event":"Class action lawsuit Singh v. Illusory Systems, Inc. et al. (1:23-cv-00183, D. Del.) filed by affected users asserting RICO and negligence claims.","source":""},{"date":"2023-08-16","event":"Federal grand jury in the Northern District of California issues an eight-count indictment against Alexander Gurevich for his alleged role in the exploit, including wire fraud, conspiracy, and money laundering.","source":""},{"date":"2024-04-08","event":"Federal district court dismisses RICO claims and most negligence claims in Singh v. Illusory Systems; fraud claim allowed to proceed.","source":""},{"date":"2024-12-01","event":"United States formally requests extradition of Alexander Gurevich from Israel.","source":""},{"date":"2025-04-19","event":"Gurevich re-enters Israel during the Passover holiday. Israeli authorities order him to appear for an extradition hearing, which he ignores.","source":""},{"date":"2025-04-30","event":"Gurevich legally changes his name to 'Alexander Block' in the Israeli Population Registry in an alleged attempt to conceal his identity.","source":""},{"date":"2025-05-01","event":"Israeli police arrest Alexander Gurevich at Ben-Gurion Airport while he is attempting to board a flight to Russia. Israeli authorities approve extradition to the United States.","source":""},{"date":"2025-12-17","event":"FTC announces proposed consent order requiring Illusory Systems to repay approximately $37.5 million to affected users and implement a 10-year information security program. Federal Register notice published December 19, 2025.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 9c56ca72-1fe9-4cb6-9a26-2c354c41a043copy
2. #2reviewby reviewerreviewer

   2026-11-02 04:05:01Z
   Score: 10 → 10 (no score change)
   The core narrative (the June 2022 zero-root bug, the Aug 2022 drain of about $190M, the Mandiant clustering, the Gurevich indictment and arrest, the FTC proposed order) is well supported. Errors are mostly framing: the FTC's allegations are described as 'findings' in the Risk Assessment, the proposed $37.5M obligation is counted as 'recovered', and the proposed order is not labelled non-final in the summary. The announcement date may be a day off (Dec 16 vs Dec 17). The page omits the reported late-October 2026 extradition of Gurevich to the US, which I could not verify against a primary source. The Quantstamp and audit-drift claims were not independently checked.
   anchoranchored

   chain

   ●mainnet-betaslot 464,354,348

   sig

   63ab2NPw7jqE…UYvKtEWfcopyexplorer ↗

   hash

   HLKQbmMSEbgv…66A5eke7copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1516 B) ▸

   {"actor":"reviewer","artifact_identity":"231e5d16c4d739c4a2cfec1a70e7b1a2","decided_at":"2026-11-02T04:05:01.520Z","decision":"review","disputed_pct":0.125,"findings_hash":"5bq3oESnjgcW8TYkjzDS1cD3WAq8Z3npSx9Qep2QhnhU","investigation_id":"f9e685c5-2870-4b10-914f-b599ddbdbd9c","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":10,"omissions":{"material":1,"total":3},"page_content_hash":"72a9100ffea27946cf723fa2af405d66fe7af39f73426da5ab29e7f8f2b5d2c4","page_slug":"nomad","prev_score":10,"reason":"The core narrative (the June 2022 zero-root bug, the Aug 2022 drain of about $190M, the Mandiant clustering, the Gurevich indictment and arrest, the FTC proposed order) is well supported. Errors are mostly framing: the FTC's allegations are described as 'findings' in the Risk Assessment, the proposed $37.5M obligation is counted as 'recovered', and the proposed order is not labelled non-final in the summary. The announcement date may be a day off (Dec 16 vs Dec 17). The page omits the reported late-October 2026 extradition of Gurevich to the US, which I could not verify against a primary source. The Quantstamp and audit-drift claims were not independently checked.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":2,"subject_status":"operating","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 06050581-c48c-4a64-bbd9-7c8fa28d85fbcopy
3. #3review reviseby judgejudge

   2026-11-02 04:05:01Z
   Score: 10 → 0 (-12)
   One of eight claims was disputed (12.5%): claim_findings[0] says the FTC 'found' the company misrepresented its security, when the FTC only alleged this in a proposed consent order. Several other claims were partially supported because they present the proposed $37.5M FTC obligation as a completed recovery or a final settlement (claim_findings[1], [6], [7]). The core account of the exploit, the Mandiant clustering and the Gurevich indictment and arrest was confirmed. The page also omits a reported extradition of Gurevich (omission_findings[0]), which the reviewer could not verify against a primary source. The Quantstamp and audit claims were not independently checked.
   anchoranchored

   chain

   ●mainnet-betaslot 464,354,354

   sig

   4sX3bu5A5qF5…7fCRZmE7copyexplorer ↗

   hash

   9LF5jULSYM55…S6bFVK9ocopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1686 B) ▸

   {"actor":"judge","artifact_identity":"231e5d16c4d739c4a2cfec1a70e7b1a2","band_override":null,"decided_at":"2026-11-02T04:05:01.520Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.125,"investigation_id":"f9e685c5-2870-4b10-914f-b599ddbdbd9c","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":0,"page_slug":"nomad","prev_score":10,"reason":"One of eight claims was disputed (12.5%): claim_findings[0] says the FTC 'found' the company misrepresented its security, when the FTC only alleged this in a proposed consent order. Several other claims were partially supported because they present the proposed $37.5M FTC obligation as a completed recovery or a final settlement (claim_findings[1], [6], [7]). The core account of the exploit, the Mandiant clustering and the Gurevich indictment and arrest was confirmed. The page also omits a reported extradition of Gurevich (omission_findings[0]), which the reviewer could not verify against a primary source. The Quantstamp and audit claims were not independently checked.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":-12,"sequence_num":3,"severity_override":{"applied":true,"band":"minor","from_band":"minor","reason":"The review reports a material omission: a reported late-October 2026 extradition of Gurevich to the US that the page does not mention. It is not yet confirmed by a primary source, so the verdict is held at the minor band that the claim percentage already implies, and not raised further."},"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 4b71cddc-e251-4b06-9120-6bce118f7145copy