Nomad Bridge Hack (2022)
See the evidence before you trust the verdict.
Historical Investigation
This investigation covers the 2022-08-01 exploit and the acute recovery window. It is frozen there; the later bridge relaunch and the pro-rata redemption program for bridged-asset holders are noted as outcomes but not re-assessed. Evidence reflects on-chain state during the window plus public post-mortems.
On August 1, 2022, the Nomad token bridge lost roughly $190M - not to one attacker, but to hundreds. A routine upgrade had initialized the bridge's trusted root so that unproven messages verified as valid. Once the first exploit transaction landed publicly, the attack became copy-paste: replay the calldata, change the recipient, withdraw. What followed was hours of permissionless draining by a crowd, followed by a partial, socially coordinated recovery when Nomad published a return address. This investigation matters because it isolates three failure modes in one incident: an initialization parameter as the entire security boundary, an upgrade reopening a closed review, and the systemic dependency of a downstream ecosystem - Moonbeam's bridged assets lost their backing in an afternoon.
Confidence per domain, not a single score.
Incident
Attribution
Loss
Recovery
How the incident unfolded
Mid-2022
Routine upgrade plants the flaw
An upgrade to the bridge's Replica contract initializes the committed root such that the zero root is acceptable. Because unproven messages hash to a zero root, message verification now passes for anything. The bridge operates normally for weeks - the flaw is latent, waiting to be noticed.
Upgrade record and public code (verified in evidence table)
August 1, 2022
First exploit transaction lands
A transaction processes an unproven message and withdraws bridged funds. The technique is now public in the mempool and the block record: the calldata itself is the exploit kit.
On-chain transaction history
August 1-2, 2022
The permissionless drain
Hundreds of addresses replay the calldata with their own recipient, in what was widely described as the first crowd-sourced exploit. Roughly $190M in WETH, WBTC, USDC and other bridged assets leaves the contract over several hours. On Moonbeam, mad-prefixed assets lose their backing in real time.
Replayed process() calls across hundreds of addresses (verified in evidence table)
August 2-3, 2022
Recovery address and returns
Nomad publishes an official recovery address and asks participants to return funds. Some do - upwards of $35M in aggregate - with self-described white hats among them. Returns and non-returns alike are permanently distinguishable in the record.
Nomad announcement; inbound transfers to the recovery address
Late 2022
Pro-rata redemption for holders
The bridge relaunches with a redemption program letting bridged-asset holders claim a pro-rata share of recovered collateral - an explicit, on-chain acknowledgment that the IOUs were only partially backed.
Relaunch and redemption program records
What the evidence shows
Root cause
Trusted root initialized to zero
A Replica contract upgrade (0x5D94309E5a0090b165FA4181519701637B6DAEBA, created by Nomad Deployer 0xA5bD5c661f373256c0cCfbc628Fd52DE74f9BB55) initialized the committed root such that unproven (zero-root) messages passed acceptableRoot - verification became a no-op. Confirmed by Nomad deployment configuration, Immunefi PoC source, and public post-mortems.
Attack mode
Permissionless calldata replay
Hundreds of addresses copied the original exploit calldata, substituting their own recipient. Observable directly in the bridge's transaction history.
Scale
~$190M over several hours
Corroborated aggregate across WETH, WBTC, USDC and other bridged assets. Per-address and per-asset split pending independent reconstruction from raw transaction data.
Attribution
No single attacker - a crowd
Participants range from the first mover to opportunists to self-described white hats. Individual identities unverified; the categories are behavioral, not attributed.
Recovery
~$35M+ returned
Nomad published a recovery address; returns followed from a subset of participants. Aggregate return figure carries post-mortem provenance.
Downstream impact
Moonbeam bridged assets lost backing
Nomad was the canonical bridge for Moonbeam; mad-prefixed bridged assets traded at deep discounts to face value after the drain.
What XemaS found
Nomad was an optimistic-verification token bridge: messages from other chains were accepted on Ethereum after a proving window, gated by a committed merkle root in the Replica contract. The security of every withdrawal reduced to one check - is this message proven under an acceptable root? A routine upgrade broke exactly that check: the committed root was initialized to zero, and because unproven messages also carry a zero root, acceptableRoot returned true for messages that had never been proven at all. The bridge's verification became a formality that always passed.
The first exploit transaction demonstrated it publicly. From that moment the attack required no skill: anyone could take the same calldata, replace the recipient address with their own, and the bridge would pay out. The transaction history shows exactly that - hundreds of distinct addresses replaying the pattern for hours, draining roughly $190M in WETH, WBTC, USDC and other bridged assets. Some participants later described themselves as white hats securing funds; on-chain, during the window, their transactions are indistinguishable from the rest.
Nomad's response was social, not technical: it published an official recovery address and asked for returns. Upwards of $35M came back from participants who chose to return funds. Bridged-asset holders on Moonbeam - whose mad-prefixed tokens were IOUs against the drained collateral - were left holding claims on a partial pool, later addressed through a pro-rata redemption program. The flaw was one initialization parameter; the blast radius was an ecosystem.
Where the value went
Not a trail but a starburst: value left one contract toward hundreds of independent addresses in hours, then partially converged back to a single recovery address. The permanent losses sit with the addresses that kept funds; the accounting of who kept what is reconstruction work the public aggregates only approximate.
| Step | Movement |
|---|---|
| 1 | First exploit transaction withdraws against an unproven message |
| 2 | Copycat replays drain the bridge across hundreds of addresses |
| 3 | Dispersal: mixed behavior across participants |
| 4 | Partial convergence to the official recovery address |
Downstream impact
Nomad Bridge
Substantially drained; paused, later relaunched with a pro-rata redemption program against recovered collateral.
Moonbeam ecosystem
Nomad was Moonbeam's canonical bridge: mad-prefixed bridged assets (madUSDC and peers) lost their backing and traded at deep discounts. DeFi on the chain denominated in those assets inherited the loss with no local flaw - the clearest case on record of canonical-bridge concentration as systemic risk.
Bridged-asset holders broadly
Every holder of a Nomad-bridged asset held an IOU against the drained pool. The redemption program made the partial backing explicit: claims settled pro-rata, not at face value.
Who was involved
First mover
Submitted the initial exploit transaction that made the technique public. Identity unverified; the address and transaction are permanently on record.
Copycat crowd (hundreds of addresses)
Replayed the exploit calldata with substituted recipients. A behavioral grouping, not an entity: subsequent conduct diverged sharply between returners, holders, and mixers.
Returners / self-described white hats
Sent funds to the official recovery address - upwards of $35M in aggregate. The returns are verified; the stated motives are claims.
Nomad team
Operated the bridge, shipped the flawed upgrade, published the recovery address, and ran the relaunch and redemption program. Attribution public and uncontested.
Why it matters
Bridged assets are IOUs against a contract you probably never evaluated. When the bridge fails, the "USDC" on the far chain stops being USDC - Moonbeam holders discovered the difference between an asset and a claim in a single afternoon. Position sizing should treat bridge exposure as its own risk line, and prefer canonical or natively issued assets where they exist.
Evidence table
| Fact | State |
|---|---|
| Replica upgrade initialized trusted root to zero | VERIFIED |
| Unproven messages processed successfully | VERIFIED |
| Exploit replicated by copying calldata | VERIFIED |
| Total drained ~$190M | PARTIAL |
| Official recovery address published; returns received | VERIFIED |
| Moonbeam bridged assets lost backing | VERIFIED |
| Individual participant identities | UNVERIFIED |
What was not visible
Aggregate figures carry post-mortem provenance
The ~$190M drained and ~$35M+ returned are corroborated public aggregates. XemaS has not yet re-derived them from raw per-address accounting; the split across hundreds of participants is substantial reconstruction work and is marked pending.
The crowd is not one actor
Behavioral categories used here (first mover, copycats, returners) are observational groupings of addresses, not attributed entities. No claim is made about how many people controlled how many addresses.
Intent is not observable
Whether a given participant drained funds to secure or to keep them is not an on-chain fact. Returns are evidence of returns, nothing more.
What this incident teaches
Initialization parameters are the attack surface
The entire verification model reduced to one stored value, and an upgrade set it wrong. Config and initialization deserve the same adversarial review as code paths - a security property that a parameter can disable is a parameter, not a property.
Once calldata is public, an exploit is permissionless
The gap between "one attacker found a flaw" and "everyone can execute it" was one block. Incident response models that assume a single adversary and a negotiation channel fail completely against a crowd.
A bridged asset is a claim on the bridge
madUSDC was never USDC; it was an IOU that priced at face value until the collateral vanished. Every dependent chain and protocol should model its canonical bridge as a single point of systemic failure, because it is one.
Upgrades reopen closed reviews
Like Euler eight months later, the flaw arrived in an upgrade to a reviewed system. "Audited" describes a version, not a protocol. Continuous verification of live parameters - not just code at review time - is the control that was missing.
Recovery by social coordination is real but partial
The recovery address recovered a meaningful minority of funds using nothing but a Schelling point and public visibility. That is worth knowing - and it still left most of the loss unrecovered. The base-rate lesson from Euler applies with a smaller numerator.
Structurally related incidents
Relationships derived from shared taxonomy - mechanism, failure pattern, protocol family, and attribution class.
Euler Finance Exploit (2023)
- -Same root cause category: Code Defect
- -Shared failure pattern: Smart contract logic
Ronin Bridge Hack (2022)
- -Both are Bridge protocols
- -Shared failure pattern: Bridge asset custody
Harmony Horizon Bridge Hack (2022)
- -Both are Bridge protocols
- -Shared failure pattern: Bridge asset custody
Scan any address with the same evidence engine
EVM, Solana, Bitcoin, and Tron. Every scan returns verified evidence, not a traffic-light score.
Scan a token or walletNo account required for a first scan.