Résumé
On August 1, 2022, the Nomad token bridge was drained of roughly $190 million in a few chaotic hours, and it became the first large crypto theft to turn into an open, crowdsourced free for all. Nomad processed cross chain messages in two steps: prove (record a message under a confirmed Merkle root) then process (execute it). A contract upgrade initialized the Replica contract with a committed root of bytes32(0), the empty tree root, and the initializer wrote confirmAt[bytes32(0)] = 1, permanently marking the zero root as trusted. Because any unproven message hash reads back the Solidity default of bytes32(0), the validity check acceptableRoot(0x00) returned true for every message that was never proven. Attackers skipped prove() entirely and called process() with crafted calldata, releasing funds with no Merkle proof at all. After the first transaction, anyone could copy it, swap in their own address and rebroadcast, so hundreds of opportunists piled in. Bridge TVL fell from about $190.7 million to under $2,000, and only roughly $36 to $39 million (about a fifth) was ever returned.
Comment le corriger
- Reject bytes32(0) and any default or sentinel value in acceptableRoot(); add an explicit require(_root != bytes32(0)) before trusting a root.
- Guard the initializer so it requires a non-zero committed root before writing confirmAt, and disable initializers on implementation contracts.
- Authorize in process() only on a genuine proven state, never on a value (0x00) that an unset mapping also returns by default.
- Diff deployed bytecode against the exact audited commit and block any deploy that does not match.
- Re-run the full invariant suite after every upgrade: no message processes unless genuinely proven, and bytes32(0) is never an acceptable root.
Comment l’éviter dans votre code
- Never overload bytes32(0) as both the mapping default and a valid sentinel; keep the unproven and valid-root domains disjoint.
- Treat any "zero or empty value treated as valid" audit finding as potentially critical regardless of its initial severity rating, and require the auditor to sign off on the fix rather than closing it unilaterally.
- Use initializer modifiers and validate that every init parameter rejects zero.
- Fuzz and property-test proof verification against empty, absent and malformed proofs; require a positive proof record, not merely a non-revert.
- Treat audited-versus-deployed drift as a release blocker.
Détails de l’avis
How it happened
The fatal line entered the codebase on May 26, 2022, inside a commit ironically titled as a fix, committed while Quantstamp's audit was already underway. The refactor changed the messages mapping from a status enum to a bytes32 root and rewired process() to gate on acceptableRoot(messages[hash]) instead of an explicit "Proven" check. The dangerous configuration went live on June 21, 2022 (Ethereum block 15,002,481), when the Replica was upgraded and initialized with all parameters set to zero. For roughly forty days nothing happened, then on August 1 the first fraudulent process() call walked out with 100 WBTC (about $2.3 million) using no proof at all. The exploit needed no skill to copy: as Paradigm's samczsun put it, you only had to find a transaction that worked, replace the other person's address with yours, and rebroadcast it. Google's Mandiant later counted 532 addresses that each took more than $1,000, and Coinbase found that copycats (around 88 percent of the participating addresses) accounted for about $88 million of the haul. It was less a heist than a bridge smart-contract flaw turned into a public ATM.
What the audit missed and what followed
Nomad was audited. Quantstamp's report even contained a finding, "Proving With An Empty Leaf," in the same zero-or-empty-value class, rated Low Risk; Nomad dismissed it as effectively impossible to exploit, and Quantstamp replied that the team had misunderstood the issue. The finding sat on a sibling code path (prove(), not the init plus process() path actually abused), but the lesson is exact: a low-severity "empty is treated as valid" note foreshadowed a nine-figure loss. Zellic later showed the deployed Replica diverged sharply from the audited code, a textbook case of audit drift, though Nomad disputes the framing. Recovery ran through an official wallet operated with Anchorage Digital, with a standing offer to treat anyone returning at least 90 percent as a white hat; about $36 to $39 million came back. The original exploiter was anonymous and the crowd was permissionless, so most participants were never identified. One suspect, Alexander Gurevich, was charged in a 2023 US indictment and arrested in Israel in 2025; he is described as the first to trigger the bug but neither its author nor its largest beneficiary. Unlike Ronin and Harmony, there is no North Korea attribution here. Nomad relaunched a gated, KYC-restricted bridge in December 2022. It capped the worst year on record for bridges: Chainalysis tallied roughly $2 billion stolen across 13 cross-chain bridge hacks in 2022, alongside Wormhole, Ronin, Poly Network and the BNB Chain token hub.
Références
- https://medium.com/nomad-xyz-blog/nomad-bridge-hack-root-cause-analysis-875ad2e5aacd
- https://www.halborn.com/blog/post/explained-the-nomad-hack-august-2022
- https://medium.com/immunefi/hack-analysis-nomad-bridge-august-2022-5aa63d53814a
- https://blocksecteam.medium.com/attack-analysis-how-unchecked-mapping-makes-200m-losses-of-nomad-bridge-441336e28924
- https://cloud.google.com/blog/topics/threat-intelligence/dissecting-nomad-bridge-hack
- https://www.zellic.io/blog/audit-drift/
- https://github.com/nomad-xyz/monorepo/commit/46d14571f3eada6ecf9ffce8fdc3adea11e73031
- https://www.trmlabs.com/resources/blog/key-suspect-in-190m-nomad-bridge-exploit-extradited-to-the-united-states
- https://www.chainalysis.com/blog/cross-chain-bridge-hacks-2022/
- https://www.theblock.co/post/193215/nomad-to-restart-bridge-after-190-million-hack-in-august
Vulnérabilités liées
Tout Web3 →- CRITICALWEB3-KELPDAO-LAYERZERO-2026
On April 18, 2026, North Korea's Lazarus Group drained about 116,500 rsETH (roughly $292 million) from KelpDAO's LayerZero-based bridge, the largest DeFi exploit of the year. No smart contract was broken; the contracts did exactly what they were written to do. The attack was against the bridge's off-chain verification. rsETH's LayerZero channel was configured to trust a single verifier (a 1-of-1 DVN), so the attackers compromised LayerZero's internal RPC nodes, knocked out the honest external node with a denial-of-service flood, and forced that single verifier to attest to a cross-chain message that never really happened. The Ethereum side then released unbacked rsETH from escrow, leaving wrapped rsETH stranded across more than twenty chains and triggering a bank-run across DeFi.
- HIGHWEB3-FRONTEND-DNS-HIJACK-2022
A frontend hijack leaves the on-chain contracts untouched but replaces the Web2 surface serving the dApp UI with a wallet-drainer clone, so no Solidity audit can catch it. The recurring pattern: attackers take over the domain registrar or DNS provider account (or a CDN/tag-manager account), repoint the domain to a cloned site, and prompt visitors to sign malicious token approvals, EIP-2612 permit signatures, or transfers. Curve Finance was hit twice: on August 9-10, 2022 its curve.fi domain was DNS-hijacked via a compromised nameserver and drained ~$570K in USDC/DAI; and again around May 12, 2025 at the registrar level, after which Curve permanently migrated to curve.finance and announced an ENS move (Convex Finance and Resupply, which depend on Curve's data feeds, suffered dependency-driven outages but were not themselves compromised). In July 2024 a mass wave hit DeFi domains registered through Squarespace, whose forced migration off Google Domains stripped 2FA: Compound's frontend redirected to an Inferno Drainer clone and 100+ protocols were exposed (Celer blocked its takeover via domain monitoring). Ambient Finance's domain was hijacked through stolen registrar credentials on October 17, 2024. Most recently, on April 14, 2026 attackers used forged identity documents to social-engineer the registrar into handing over DNS control of CoW Swap's swap.cow.fi and cow.fi domains, redirecting users to a pixel-perfect drainer clone for about 90 minutes; over $1M was taken in roughly three hours, including 219 ETH (~$750K) from a single wallet, while CoW's contracts, backend APIs, and solver network were untouched. The same bucket includes CDN-account injections (KyberSwap's September 2022 Cloudflare/Google Tag Manager compromise, ~$265K) and BGP route hijacks that swap signed bundles for drainer code.
- HIGHWEB3-CURVE-DNS-2025
On May 12, 2025, attackers hijacked Curve Finance's primary domain, curve.fi, at the registrar and DNS level and pointed visitors at a wallet-draining clone of the site. Curve's smart contracts and on-chain funds were never touched; this was a Web2 attack on the domain, the soft underbelly that no Solidity audit can protect. The nameservers for curve.fi were swapped to attacker-controlled infrastructure at the registrar (iwantmyname, the same registrar implicated in Curve's 2022 hijack), and the clone prompted users to approve malicious token transactions. On-chain analysts estimated user losses around $520,000, most of it taken in the first ninety minutes. Curve repointed the domain to neutral nameservers, then permanently migrated to curve.finance and signaled a move toward decentralized (ENS) hosting.
- CRITICALWEB3-KILOEX-2025
On April 14, 2025 the perpetuals DEX KiloEx lost about $7.5 million across BNB Chain, Base, opBNB, and Taiko to what was reported as oracle price manipulation but was really an access-control failure. KiloEx's price feed (KiloPriceFeed.setPrices) was meant to be reachable only through a keeper-gated call chain, but the top-level MinimalForwarder.execute function was publicly callable and validated an attacker-supplied signature against attacker-supplied data, letting anyone forge a trusted call that reached setPrices and write an arbitrary price. The attacker set a market price far below true value, opened a leveraged position, then set the price far above value and closed it in the same flow, extracting fabricated profit from the vault; the sequence was repeated across all four chains, with a single transaction netting $3.12M. Reporting that framed it as flash-loan oracle manipulation was imprecise: no market liquidity was moved, the price was simply written directly through the unprotected forwarder. After KiloEx offered a 10% (~$750K) whitehat bounty and no legal action, the attacker returned essentially all of the funds by April 18, 2025.
- CRITICALWEB3-BYBIT-2025
On 21 February 2025, the crypto exchange Bybit lost about $1.5 billion in ether, the largest hack in history, to North Korea's Lazarus Group. Bybit had done what custody best-practice prescribes: the funds sat in a cold wallet behind a multisig requiring several human signers. The attackers beat it anyway, not by stealing keys but by tampering with what the signers saw. Weeks earlier they had compromised a developer at Safe, the multisig-wallet provider, and slipped malicious code into the Safe web app, so that when Bybit's executives reviewed a routine transfer, the screen showed a legitimate transaction while their hardware wallets were actually signing a malicious one that handed the wallet to the attacker. It is the defining lesson that a multisig is only as trustworthy as the screen you approve it on, and that blind-signing is the modern crypto catastrophe.
- CRITICALWEB3-RADIANT-2024
On October 16, 2024, the cross-chain lending protocol Radiant Capital lost roughly $50M (about $53M across Arbitrum and BSC) after attackers compromised the devices of at least three of its multisig signers. Initial access began September 11, 2024 via a Telegram message spoofing a trusted former contractor, delivering a ZIP with a decoy PDF that was actually a macOS application carrying INLETDRIFT backdoor malware. The malware sat between the signers' browsers and their hardware wallets, so the Safe (Gnosis) UI and Tenderly simulations displayed correct data while the signers blind-signed a malicious transferOwnership() call on the LendingPoolAddressesProvider contract; the 3-of-11 threshold was met and the attacker then upgraded the pools to a malicious implementation and drained them. Mandiant assessed with high confidence the attack was conducted by North Korea-linked UNC4736 (aka Citrine Sleet/AppleJeus), part of the Lazarus cluster. Funds were not recovered and the protocol later wound down.