Videos
Nomad crypto bridge loses $200 million in a 'chaotic' hack. After a few quiet months, it's happened again: another blockchain bridge hack with losses in the hundreds of millions of dollars. Nomad, a cryptocurrency bridge that lets users swap tokens between blockchains, is the latest to be hit after a frenzied attack on Monday, which left almost $200 million of its funds drained. The hack was acknowledged by the Nomad project's official Twitter account on Monday, August 1st, initially as an "incident" that was being investigated. In a further statement released early Tuesday morning, Nomad said that the team was "working around the clock to address the situation" and had also notified law enforcement. In another Twitter thread, samczsun — a researcher at the crypto and Web3 investment firm Paradigm — explained that the exploit was made possible by a misconfiguration of the project's main smart contract that allowed anyone with a basic understanding of the code to authorize withdrawals to themselves. "This is why the hack was so chaotic," samczsun wrote. "[Y]ou didn't need to know about Solidity or Merkle Trees or anything like that. All you had to do was find a transaction that worked, find/replace the other person's address with yours, and then re-broadcast it." A further post-mortem from blockchain security auditing firm CertiK noted that this dynamic created its own momentum, where people who saw funds being stolen using the above method were able to substitute their own addresses to replicate the attack. This led to what one Twitter user described as "the first decentralized crowd-looting of a 9-figure bridge in history." In a more optimistic take, Nassim Eddequiouaq, crypto CISO at Andreessen Horowitz, suggested the funds could be reclaimed from the "whitehats that drained preventively," though the identities of those that obtained the funds from Nomad appear to be largely unknown.