Fact-check findings

The reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.

1. #1[disputed][awaiting moderator]in section: Risk Assessment

   “The FTC found that the company misrepresented its security posture to users while failing to implement basic coding, vulnerability management, and incident response standards.”

   reviewerThe FTC 'found' that the company misrepresented its security posture; the FTC only alleged this in a proposed consent order, with no admission or finding.A proposed consent order contains allegations, not findings. The Recovery Efforts section already uses 'alleged'; the Risk Assessment section overstates it.
   Proposed correction (not yet applied)

   The FTC alleged that the company misrepresented its security posture to users while failing to implement basic coding, vulnerability management, and incident response standards.
   citedwww.ftc.gov/news-events/news/press-relea…security-program

The cited evidence supports part of the claim but not all of it.

1. #2[partially supported][awaiting moderator]in section: Risk Assessment

   “Only approximately $36–37.5 million (roughly 19 percent) was recovered through voluntary returns and the FTC-mandated repayment obligation.”

   reviewerThe $37.5 million FTC repayment obligation is counted as funds 'recovered'; it is a proposed, not yet final, obligation.The $36M voluntary return is supported. The $37.5M is a future obligation under a proposed order, and the FTC page gives no fixed sum, so it is not a completed recovery.
   citedwww.theregister.com/2025/12/17/nomad_ftc_settlement/
2. #3[partially supported][awaiting moderator]in the timeline

   “2025-12-17”

   reviewerFTC announced the proposed consent order on 2025-12-17.The FTC fetch indicates a December 16 announcement and the press coverage is dated December 17. The FTC date was not independently confirmed beyond the fetch summary, so this is a low-severity discrepancy.
   citedwww.ftc.gov/news-events/news/press-relea…security-program
3. #7[partially supported][awaiting moderator]in section: Recovery Efforts

   “The settlement was pending final FTC vote and public comment as of the date of this report.”

   reviewerIllusory Systems must repay approx. $37.5M within one year; the order was pending final vote.The comment period closed on Jan 20, 2026, so 'pending ... as of the date of this report' needs a check against whether the FTC has since finalized the order. I found no final-approval notice, and one law-firm roundup claims it was finalized, which is unverified.
   citedwww.theregister.com/2025/12/17/nomad_ftc_settlement/
4. #8[partially supported][awaiting moderator]in the summary

   “in December 2025 agreed to a settlement requiring repayment of $37.5 million to affected users.”

   reviewerSummary: FTC enforcement and a December 2025 settlement requiring repayment of $37.5M.The summary omits that the order was proposed and not final.
   citedwww.ftc.gov/news-events/news/press-relea…security-program

The cited evidence supports the claim as written.

1. #4[confirmed][no action needed]in section: On-Chain Evidence

   “Group A (three addresses) stole approximately $18.8 million collectively; one address returned 77.6 percent of its haul to Nomad's recovery address, while the other two returned only 1.7 percent and 3.4 percent respectively.”

   reviewerMandiant Group A (three addresses) stole about $18.8M; one returned 77.6% and the others 1.7% and 3.4%.Matches the Mandiant post.
   citedcloud.google.com/blog/topics/threat-inte…omad-bridge-hack
2. #5[confirmed][no action needed]in section: On-Chain Evidence

   “Group D, assessed by Mandiant with high confidence as a single coordinated actor or group, stole approximately $54.5 million — roughly 29 percent of the total.”

   reviewerGroups B, C and D laundering details and amounts, including the Rari Capital link and Group D at about $54.5M.The 29% figure is derived, not stated by Mandiant, but is arithmetically correct.
   citedcloud.google.com/blog/topics/threat-inte…omad-bridge-hack
3. #6[confirmed][no action needed]in section: Recovery Efforts

   “A federal grand jury in the Northern District of California had indicted Gurevich on August 16, 2023 on eight counts including wire fraud, conspiracy, and money laundering.”

   reviewerGurevich was indicted Aug 16, 2023 on eight counts in N.D. Cal., arrested in May 2025 at Ben-Gurion Airport after a name change, with the extradition request in Dec 2024.Core facts hold. The name-change date differs by a day between sources, so I did not dispute it.
   citedwww.bleepingcomputer.com/news/legal/isra…90m-crypto-hack/