Coinbase-backed cross-chain protocol Nomad hacked in a $150 Million Exploit

On Monday evening, attackers exploited the cross-chain blockchain protocol Nomad, the latest among several bridge exploits this year. Although the exact amount isn’t confirmed, reports suggest that the hackers stole anywhere north of $150 million.

Taking cognizance of the matter, Nomad updated its users for the same. The company also asked users to be aware of impersonators. Nomad tweeted:

We are aware of the incident involving the Nomad token bridge. We are currently investigating and will provide updates when we have them.

We’re aware of impersonators posing as Nomad and providing fraudulent addresses to collect funds. We aren’t yet providing instructions to return bridge funds. Disregard comms from all channels other than Nomad’s official channel.

As the team investigates, the MoonBeam network has been essentially paused. Thus, MoonBeam’s use for regular transactions and smart contract interactions will be disabled.

Last week itself, Nomad announced securing $22 million in seed investments with giants like Coinbase Ventures, Polychain Capital, and others.

The Details of the Hack

It all started with a suspicious transaction removing 100 wrapped Bitcoin (WBTC) worth $2.3 million from the bridge. However, the incident has seen a number of tokens exploited from the bridge.

This includes the likes of Wrapped Ether (WETH), Covalent Query Token (CQT), USD Coin (USDC), Frax (FRAX), IAGON (IAG), Hummingbird Governance Token (HBOT), Card Starter (CARDS), GeroWallet (GERO), Dai (DAI), and others.

Interestingly, this exploit has been quite different from other bridge exploits occurring in 2022. During the hacking event, hundreds of addresses received tokens directly from the bridge.

Furthermore, exploiters removed all of these tokens in an unusual pattern. They removed tokens from the bridge in equivalent denominations. The attackers executed over 200 transactions each with exactly 202,440.725413 USD.

Bridge exploits have been a very common form of exploit over the last years. Millions of dollars of investors’ funds have been lost in this. In the past, Ethereum co-founder Vitalik Buterin has expressed concern over the use of bridges for cross-chain transfer of funds.