Nomad: the flaw is discovered, then hundreds of addresses are used

On August 1, 2022, the reserves of the Nomad Bridge were gradually emptied. This system must transmit verified messages between blockchains. However, a configuration change causes messages that should not be recognized as valid to be accepted.

The default is to initialize a trust value. A lack of evidence can be treated as an acceptable state. The error is particularly serious because it affects the fundamental decision of the bridge: should we allow the exit of these assets?

After the first fraudulent withdrawals, other actors understand that they can reproduce the observed principle. More than 300 addresses participate in the event according to Nomad’s balance sheet. This does not necessarily mean 300 separate people: one person can control multiple addresses.

The amount stolen exceeds $180 million, often rounded up to about $190 million in analysis. The multitude of operators makes the situation unusual. Some present themselves as people who have sheltered the funds, others keep them or disperse them.

Nomad interrupts its service, organizes a response and publishes a return of assets procedure. Funds are coming back, but just seeing an address participate is not enough to give it a protective intent. The refunds must be distinguished from the total amount paid out.

This case is less the story of a solitary genius than that of a defective rule that has become visible. When a first exploitation reveals a reusable weakness, the attack can change scale even before the repair is available.