On August 1, 2022, the Nomad bridge was drained of roughly $190M according to multiple reports, with early figures near $200M. A June 21, 2022 upgrade to the Replica contract reportedly initialized the trusted root to 0x00, so unproven messages were accepted as valid. Once the first exploit was visible, many unrelated actors copied the calldata and redirected funds to their own addresses, and reported recoveries and legal cases cover only part of the losses.
We message you the minute a major hack, exploit or fraud is confirmed, with the amount lost and what to do. Free, no spam, stop any time.
According to the research notes, a routine upgrade to the bridge's Replica contract on June 21, 2022 left the trusted root at bytes32(0) / 0x00. This meant that messages with no valid Merkle proof could be treated as proven. On August 1, 2022, attackers called process() with fabricated messages and drained assets from the bridge contract on Ethereum.
Reporting says the exploit became a copycat event: after the first successful transaction was visible, others could reuse the calldata and replace the recipient address with their own. Coverage described it as a 'crowd looting' event involving many unrelated actors.
Nomad acknowledged the incident on August 2, said it was investigating, and said it had notified law enforcement and engaged blockchain forensics firms. Some participants reportedly drained funds to prevent malicious actors from taking everything, and white-hat returns followed.
The bridge's message validation trusted a root value of 0x00 that was set by the upgrade's initialization. Because the default state matched the root the contract accepted, an attacker could submit a fabricated message directly to process() and have it pass as proven without any legitimate Merkle proof.
Because the flaw was reproducible, the calldata of a successful transaction could be copied and the recipient swapped. This turned a single configuration error into a mass-drain event involving many participants, according to the research notes.
Reuters reportedly said a small proportion of funds was moved to a mixer while about $95M sat in three other wallets early in the incident. BlockSec's tracing reportedly found about $17M moved into Tornado Cash from 16 profit addresses. Coinbase's analysis reportedly says some funds were bridged from Moonbeam and 100 WBTC was swapped for WETH on Uniswap. Recovery figures conflict: about $9M from early white-hat returns (Reuters/The Block); more than $36M returned from over 40 addresses (blockclarityhub); about $34.1M (ynetnews); and about $37.5M in nominal value per the FTC as reported in the research. The majority of funds was reportedly not recovered.
| Address | Chain | Role | Source |
|---|---|---|---|
0x94A84433101A10aEda762968f6995c574D1bF154 | Ethereum | recipient (Nomad recovery wallet published 2022-08-03) | source |
0x56D8B635A7C88Fd1104D23d632AF40c1C3Aac4e3 | Ethereum | exploiter (publicly identified in reporting, unverified) | source |
0xBF293D5138a2a1BA407B43672643434C43827179 | Ethereum | exploiter (publicly identified in reporting, unverified) | source |
0xB5C55f76f90Cc528B2609109Ca14d8d84593590E | Ethereum | exploiter (publicly identified in reporting, unverified) | source |
Every address is from a public source. Check any wallet in the dirty wallet checker.
Nomad acknowledged the incident on August 2, 2022, said it was investigating, and notified law enforcement. It engaged TRM Labs and other forensics firms to trace funds, published a recovery address, offered a 10% bounty for returns of at least 90%, and said cooperating white hats would not be prosecuted. The FTC later brought a case against the operator, citing inadequate security and incident response, and described repayment obligations. The research does not show a dedicated insurance fund announced at the time.
Reported losses of roughly $190M, with some reports citing up to nearly $200M, hit users and liquidity on the bridge and added to concern about bridge security across the market. Later analysis reportedly found over $186M in ERC-20 tokens stolen during the attack window. Users reportedly suffered large losses, and the FTC reportedly said users lost more than $100M. The research does not provide token-by-token price moves.
72% negative · 5% positive · the rest neutral · themes: bridge security, smart-contract upgrade error, copycat crowd looting, white-hat returns, law enforcement and prosecution, FTC enforcement
How we report: Sentinel reads news, investigators' posts, company statements and on-chain data, attributes every claim to its source and marks unconfirmed numbers as reported. Severity measures size and systemic risk; the response score measures how fast and transparently users were protected. Not financial advice and not a finding of guilt. Corrections: contact us.
New exploit reports, major incidents and security updates from VaultX. Free. You choose below; nothing starts until you opt in.
On Telegram, press Start in the bot to subscribe. New reports are also posted on our alerts channel. Not financial advice.
VaultX