Pierluigi Paganini August 04, 2022

The cryptocurrency bridge Nomad is the last victim of a cyber heist, threat actors stole almost $200 million of its funds.

Another crypto heist made the headlines, threat actors stole nearly $200 million worth of cryptocurrency from the bridge Nomad. Nomad Bridge is a cross-chain bridge between Ethereum, Moonbeam, Avalanche, Evmos and Milkomeda.

The project confirmed the incident and is investigating the case after it has notified law enforcement.

According to researcher ‘samczsun’ from Paradigm, an upgrade made by the Nomad team has introduced a security flaw. It changed the verification process for the messages allowing attackers to copy/paste transactions and steal the funds from the bridge. Attackers copied the original transaction and replaced the address with their own.

“The Nomad token bridge appears to have experienced a security exploit that has allowed hackers to systematically drain the bridge’s funds over a long series of transactions.The vulnerability was in the initialization process where the “committedRoot” is set as ZERO. Therefore, the attacker was able to bypass the message verification process and drain the tokens from the bridge contract. Due to this flawed upgrade, users could exploit bridge funds by copying the original hacker’s transaction calldata and replacing the original address with a personal one.” reads the analysis published by blockchain security firm CertiK. “The transaction then processed and successfully removed funds from the bridge.”

According to CertiK, other hackers, bots, and community members replicated the initial attack in four hours, draining the funds from the bridge.

The Twitter user ‘foobar’ pointed out that the issue allegedly involved in the cyber heist was discovered along with tens of other issues during an audit conducted this year by blockchain security firm Quantstamp.

However, Nomad believes that the attack was not coordinated by a single attacker, instead many white hat hackers or security researchers may have transferred tokens into their own addresses to protect the funds. If confirmed, the white hat hackers will likely return the funds, for this reason, Nomad has provided a wallet address where they can be returned.

According to CertiK, since the beginning of the year, five cross-chain bridge attacks have led to losses of $1,317,000,000, amounting to 57% of the total losses in Web3 in 2022. The Nomad Bridge exploit ranks as 3rd largest attack this year, behind the Ronin Bridge ($624m) and Wormhole Bridge ($326m) exploits.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, bridge)

[adrotate banner=”5″]

[adrotate banner=”13″]