On Monday, the Nomad cross-chain token bridge was attacked, and the attackers practically drained the protocol of all its cash. Nearly $200 million worth of cryptocurrency was lost as a result of the hack.
Similar to other cross-chain bridges, Nomad enables users to transfer tokens back and forth between various blockchains. The attack on Monday is the most recent in a line of widely reported incidents that have raised concerns about the safety of cross-chain bridges.
“An investigation is ongoing and leading firms for blockchain intelligence and forensics have been retained. We have notified law enforcement and are working around the clock to address the situation and provide timely updates. Our goal is to identify the accounts involved and to trace and recover the funds.”
The Nomad Team
Bridges typically function by reissuing tokens in “wrapped” form on a different chain after locking them up in a smart contract on one network.
The wrapped tokens lose their backing if the smart contract where they were initially deposited is compromised, as happened in Nomad’s instance, making them worthless.
A researcher at the cryptocurrency investment company Paradigm named “samczsun” explained on Twitter that a recent change to one of Nomad’s smart contracts made it simple for users to counterfeit transactions. The Nomad bridge may thus be used by users to withdraw money that did not genuinely belong to them.
The Nomad attack was a free for all, unlike some bridge attacks where a single perpetrator is responsible for the entire vulnerability.
“You didn’t need to know about Solidity or Merkle Trees or anything like that. All you had to do was find a transaction that worked, find/replace the other person’s address with yours, and then re-broadcast it,” said samczsun.
Bridge attacks have increased in frequency in recent months as cryptocurrency users have shown a greater desire to transfer funds between various blockchains.
While cross-chain bridges have enabled the spread of fledgling blockchains, bridge failures can be disastrous for smaller chains that depend on them for a significant portion of their overall liquidity.
Investors were lured in by Nomad’s promise that its platform would be inherently safer than its competitors.
Coinbase Ventures and OpenSea, two of the biggest names in the cryptocurrency industry, were among the investors in the company’s $225 million seed round that took place in April, it was just announced last week.
