Nomad’s copy-paste heist: a broken message check and the long work of recovery

1. A bridge accepted what it had not verified

Nomad connected blockchains by carrying messages between them. Its Replica contract helped authenticate incoming messages before the BridgeRouter acted on them. In the optimistic design, a message was associated with a Merkle root whose waiting period had to expire. That relationship between a message, its root and the root’s confirmation time was supposed to separate legitimate bridge activity from fabricated instructions.^[3]

Nomad’s August 5 root-cause analysis dates the production upgrade to June 21, 2022. It explains that a change to message processing interacted with existing initialization: the zero root had a confirmation time of 1. Looking up a message hash with no entry in the message-to-root mapping also returned zero. When the updated check used that default value, the root appeared acceptable and an unproven message could pass.^[3]

The failure was in how stored values were interpreted. It did not require an empty payload to hash to zero. Fraudulent instructions reached contracts that trusted Replica’s authentication. The official analysis also explains why Watchers did not intervene: they monitored Updater-key compromises, while this path needed no fraudulent Updater signature. A defense aimed at one failure mode had not detected this implementation bug.^[3]

2. The exploit became a pattern others could copy

The attack unfolded on August 1. CertiK’s analysis illustrates one transaction in which the Ethereum side released 100 WBTC; it labels this an example, rather than establishing the first attack’s exact minute. Once a successful call was visible, later participants could adapt the input and direct a payout to another recipient address.^[1][2]

Changing that address also changed the message being submitted. Nomad’s official account states that forged messages could pass provided they had not already been processed. The exploit bypassed bridge-message authentication; it did not abolish ordinary Ethereum transaction signing or make one processed message an unlimited cash dispenser. This is why copying the pattern and repeating an identical completed message are different operations.^[3]

Rekt’s contemporary report described copycats and automated activity alongside people claiming to safeguard funds. Its account of the copying mechanism ended with this practical distinction:^[2]

swapping out their address in place of the previous exploiter’s.^[2]

— Rekt News

3. One incident, several dated measures of the damage

As assets left the bridge, investigators measured a moving event. CertiK estimated roughly $190 million drained. Elliptic’s account used more than $156.4 million and identified over 40 exploiters and more than 200 contracts used to automate attacks. These are attributed observations, not a single reconciled ledger or a percentage identifying participants as ordinary investors.^[1][4]

The stolen assets included WETH, WBTC and stablecoins. Elliptic reported about $15,000 remaining in the Ethereum contract at midday on August 2, with $16 million returned in the article’s August 3 update. A depleted reserve affected the backing of bridged assets. It did not by itself establish the final amount users would recover, or the identities and motives of everyone behind an address.^[4]

Nomad’s August 17 update gave a later project accounting: more than $186 million taken, over 300 unique addresses involved and more than $37 million recovered, about 20%. The team described ongoing tracing and returns. Differences in dates and accounting boundaries matter; subtracting an early return estimate from a rounded headline cannot turn the remainder into a proven permanent loss.^[6]

4. Returning funds was only the beginning

On August 5, Nomad published a bounty of up to 10% for parties returning at least 90% of the total they had taken to its official recovery wallet. The FAQ said Nomad would not take legal action against qualifying white hats and would advocate against criminal charges. Those were the project’s commitments and advocacy, not a government grant of immunity.^[5]

Recovery also required deciding who could receive which assets. The August 17 plan described valid transfers still in flight, bridged tokens that continued to trade and returns made in different tokens from those originally taken. Nomad was designing a restart to distribute recovered assets rather than letting the first claimants exhaust the remaining reserves. At that point the restart was still a plan.^[6][7]

The relaunch guide, published December 7 and updated December 20, subsequently announced that the token bridge had relaunched for unbridging. It described KYC/AML checks and non-transferable NFTs recording claims to proportional shares of recovered assets, including future recoveries if available. New canonical deposits were not allowed under that guide. This recovery mechanism was not evidence that every user had been repaid in full; the incident left both a deployment lesson and a complicated distribution problem.^[7]