In one of the most extensive hacks since Axie Infinity's Ronin Bridge Sidechain in March, an exploit on the Nomad token bridge has allowed attackers to rob the bridge of roughly $190 million.
Security firm PeckShield told Decrypt that the funds stolen were denominated in Ethereum, USDC, DAI, FXS, and CQT.
"We are aware of the incident involving the Nomad token bridge. We are currently investigating and will provide updates when we have them," Nomad tweeted Monday afternoon.
We are aware of the incident involving the Nomad token bridge. We are currently investigating and will provide updates when we have them.
The Nomad bridge is a protocol allowing users to move digital assets between different blockchains, including Avalanche (AVAX), Ethereum (ETH), Evmos (EVMOS), Milkomeda C1, and Moonbeam (GLMR).
Nomad TVL plummeted as funds were lifted from the protocol. Image: DeFi Llama.
While details from Nomad are scarce, some have pointed to a configuration error in a smart contract that Nomad uses to process messages as the cause, allowing millions to be drained from Nomad's liquidity pool.
"It all started when @officer_cia shared @spreekaway's tweet in the ETHSecurity Telegram channel," Sam Sun, a researcher at crypto investment firm Paradigm, tweeted. "Although I had no idea what was going on at the time, just the sheer volume of assets leaving the bridge was clearly a bad sign."
2/ It all started when @officer_cia shared @spreekaway's tweet in the ETHSecurity Telegram channel. Although I had no idea what was going on at the time, just the sheer volume of assets leaving the bridge was clearly a bad sign pic.twitter.com/klHNfthVvj
"It turns out that during a routine upgrade," Sun continued. "The Nomad team initialized the trusted root to be 0x00. To be clear, using zero values as initialization values is a common practice. Unfortunately, in this case it had a tiny side effect of auto-proving every message."
Nomad bridge attack ‘a frenzied free-for-all’
Sun likened what happened next to “a frenzied free-for-all” because it took little technical knowledge to leverage the exploit.
“You didn't need to know about Solidity or Merkle Trees or anything like that,” Sun wrote. “All you had to do was find a transaction that worked, find/replace the other person's address with yours, and then re-broadcast it.”
Similarly, blockchain security firm Certik reported that attackers could exploit the bug by simply copying and pasting transactions. The firm added that people could exploit the upgrade “by copying the original hacker's transaction calldata and replacing the original address with a personal one.”
🚨Explaining the Nomad bridge hack 🚨
All credit to @samczsun for doing the heavy lifting of diagnosing the precise vulnerability in his postmortem
How did we get the first decentralized crowd-looting of a 9-figure bridge in history? pic.twitter.com/v5u6mrKQv1
In this way, the bridge was drained of nearly all of its funds.
"Nomad's bridge got owned in a similar manner to Qubit's QBridge," tweeted a16z security engineer Matt Gleason. "An insecure configuration of the bridge caused a specific path to allow any transaction sent. The error is inside the Replica's ‘process’ function."
1/ Nomad’s bridge got owned in a similar manner to Qubit’s QBridge. An insecure configuration of the bridge caused a specific path to allow any transaction sent. The error is inside the Replica’s “process” function.
"The system will accept any message that it has never seen before and process it as if it were genuine, meaning that all you need to do is ask for all the bridge's money and you'll get it," he added.
According to the FTC, cyberattacks against crypto projects appear to show no sign of slowing down, with over $1 billion in crypto stolen since 2021.
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
Grayscale has challenged the U.S. Security and Exchange Commission’s move to pause the debut of its exchange-traded fund that holds Bitcoin, Ethereum, Solana, XRP, and Cardano, alleging its investors are “suffering harm” as a result of the hold-up.
In a letter dated July 8, the asset manager urged the Securities Commission to allow its Digital Large Cap Fund to begin trading.
Grayscale added that it may file a petition to force the regulator to allow its fund to begin trading as soon as possib...
SharpLink Gaming shares rose on Friday after the largest publicly traded Ethereum treasury firm said that it had acquired $30 million worth of Ethereum from the Ethereum Foundation.
SharpLink’s stock was changing hands around $20 per share, a 71% gain over the past week, according to Yahoo Finance. The performance coincides with Ethereum’s climb above $3,000 for the first time in five months, a 17% gain, according to crypto data provider CoinGecko.
The non-profit organization that funds research...
Stablecoin platform Agora has raised $50 million in a Series A round led by Paradigm, with additional backing from Dragonfly Capital, as it seeks to capitalize on growing interest in the potentially lucrative sector.
The funding will support the expansion of Agora’s all-in-one system for issuing and managing stablecoins, as well as the introduction of its new white-labeled stablecoin product, the company announced Thursday.
The raise comes as the U.S. Congress is considering stablecoin legislati...