Hackers stole $200 million from the Nomad crypto bridge

The cryptocurrency bridge Nomad is the last victim of a cyber heist, threat actors stole almost $200 million of its funds.

Another crypto heist made the headlines, threat actors stole nearly $200 million worth of cryptocurrency from the bridge Nomad. Nomad Bridge is a cross-chain bridge between Ethereum, Moonbeam, Avalanche, Evmos and Milkomeda.

The project confirmed the incident and is investigating the case after it has notified law enforcement.

According to researcher ‘samczsun’ from Paradigm, an upgrade made by the Nomad team has introduced a security flaw. It changed the verification process for the messages allowing attackers to copy/paste transactions and steal the funds from the bridge. Attackers copied the original transaction and replaced the address with their own.

1/ Nomad just got drained for over $150M in one of the most chaotic hacks that Web3 has ever seen. How exactly did this happen, and what was the root cause? Allow me to take you behind the scenes pic.twitter.com/Y7Q3fZ7ezm

— samczsun (@samczsun) August 1, 2022

Some updates on Nomad:
1. The upgrade did introduce the bug, but not through initializing the 0x00 root (that was there since deployment). Instead, it changed how messages were checked to be proven. This is my mistake
2. The bug Quantstamp reported is not the same as this bug https://t.co/7sYNT06zPA pic.twitter.com/kggPjnS0sT

— samczsun (@samczsun) August 3, 2022

“The Nomad token bridge appears to have experienced a security exploit that has allowed hackers to systematically drain the bridge’s funds over a long series of transactions.The vulnerability was in the initialization process where the “committedRoot” is set as ZERO. Therefore, the attacker was able to bypass the message verification process and drain the tokens from the bridge contract. Due to this flawed upgrade, users could exploit bridge funds by copying the original hacker’s transaction calldata and replacing the original address with a personal one.” reads the analysis published by blockchain security firm CertiK. “The transaction then processed and successfully removed funds from the bridge.”

According to CertiK, other hackers, bots, and community members replicated the initial attack in four hours, draining the funds from the bridge.

Explaining the Nomad bridge hack

All credit to @samczsun for doing the heavy lifting of diagnosing the precise vulnerability in his postmortem

How did we get the first decentralized crowd-looting of a 9-figure bridge in history? pic.twitter.com/v5u6mrKQv1

— foobar (@0xfoobar) August 2, 2022

The Twitter user ‘foobar’ pointed out that the issue allegedly involved in the cyber heist was discovered along with tens of other issues during an audit conducted this year by blockchain security firm Quantstamp.


However, Nomad believes that the attack was not coordinated by a single attacker, instead many white hat hackers or security researchers may have transferred tokens into their own addresses to protect the funds. If confirmed, the white hat hackers will likely return the funds, for this reason, Nomad has provided a wallet address where they can be returned.

Nomad Bridge Funds Recovery Process

Dear white hat hackers and ethical researcher friends who have been safeguarding ETH/ERC-20 tokens,

Please send the funds to the following wallet address on Ethereum: 0x94A84433101A10aEda762968f6995c574D1bF154 pic.twitter.com/UF623JSZ8u

— Nomad (⤭) (@nomadxyz_) August 3, 2022

According to CertiK, since the beginning of the year, five cross-chain bridge attacks have led to losses of $1,317,000,000, amounting to 57% of the total losses in Web3 in 2022. The Nomad Bridge exploit ranks as 3rd largest attack this year, behind the Ronin Bridge ($624m) and Wormhole Bridge ($326m) exploits.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, bridge)

The post Hackers stole $200 million from the Nomad crypto bridge appeared first on Security Affairs.

Leer másSecurity Affairs

Leave a Reply

Your email address will not be published.