The cryptocurrency bridge Nomad was hacked and threat actors stole almost $200 million worth of cryptocurrency. Nomad Bridge is a cross-chain bridge between Ethereum, Moonbeam, Avalanche, Evmos and Milkomeda. It allows users to swap cryptos between two or more blockchains.
The hack was acknowledged by the Nomad project’s official Twitter handle. The company confirmed the attack and is investigating the case after it has notified law enforcement.
According to researcher ‘samczsun’ from crypto and Web3 investment firm Paradigm, there was a security flaw after an upgrade made by the Nomad team. It changed the verification process for the messages allowing attackers to copy/paste transactions and steal the funds from the bridge. Attackers copied the original transaction and replaced the address with their own.
According to an analysis published by blockchain security firm CertiK, the users could exploit bridge funds by copying the original hacker’s transaction call data and replacing the original address with a personal one, due to the flawed upgrade. The transaction then processed and successfully removed funds from the bridge.
According to CertiK, other hackers, bots, and community members replicated the initial attack in four hours, draining the funds from the bridge.
Nomad believes that the attack was not coordinated by a single attacker, instead many white hat hackers or security researchers may have transferred tokens into their own addresses to protect the funds. If confirmed, the white hat hackers will likely return the funds, for which Nomad has provided a wallet address where they can be returned.
The company says that it is actively working with a leading intelligence firm TRM Labs, and law enforcement to trace fund flows and identify recipient wallets to coordinate the return of funds.
This is not the first time blockchain bridges have been a target of cybercriminals. More than $1 billion in crypto assets has been stolen through bridge exploits so far in 2022.
Image Credits : The Cryptonomist
Comments