Nomad Bridge was compromised through an implementation bug in the Replica contract that allowed forged messages to pass authentication because an unproven message could map to bytes32(0) and acceptableRoot(bytes32(0)) returned true. Post-incident material documented bounty and recovery-wallet procedures, while broader CTI reporting discussed Nomad in the context of cryptocurrency bridge exploitation and North Korea-linked targeting of the crypto sector.
Annex 95: Suspected DPRK cyberattacks on cryptocurrency-related companies (2017-2023) investigated by the Panel. Table 2022: Victim: Nomad; Date: August; Amount (USD equivalent): 190m; Location: U.S.
Reported: 2022-08; Victims: Nomad Bridge; Motivations: FinancialGain; Sectors: Cryptocurrency; Countries: United States
The Nomad Bridge hack included significant copycat draining alongside Lazarus-attributed activity.
Nomad Bridge has been torn apart, with $190M of liquidity drained in a savage attack lasting two and a half hours.