As the cryptocurrency market experienced a sharp downturn in early August 2024, with Bitcoin falling below $61,000 and Ethereum dropping to approximately $2,900, a familiar threat actor has reemerged. The Nomad bridge exploiter, responsible for one of the most significant cross-chain bridge hacks in August 2022, has been spotted moving stolen funds to capitalize on discounted ETH prices. This development highlights the persistent challenges of cross-chain security and the opportunistic nature of cybercriminals operating in the cryptocurrency space.
The Exploit Mechanics
The original Nomad bridge exploit occurred in August 2022, when an attacker drained approximately $190 million from the cross-chain messaging protocol. The vulnerability stemmed from a flawed initialization process in the Nomad Replica contract, which allowed anyone to craft a valid transaction proof of zero values. This essentially meant that every message could be proven as valid, enabling arbitrary fund withdrawals.
Now, nearly two years later, blockchain analytics firm Lookonchain reported that the same exploiter used 39.75 million stolen DAI tokens to purchase 16,892 ETH during the market crash. The purchase occurred as Ethereum’s value plummeted by more than 21% over a 24-hour trading period, giving the hacker access to heavily discounted ETH. Shortly after the acquisition, the hacker began routing the stolen funds through Tornado Cash, the crypto mixer commonly used to obfuscate on-chain transactions.
Additional blockchain investigator PeckShield confirmed that the Nomad exploiter simultaneously transferred 17.75 ETH to an intermediary Ethereum address. Approximately 2,400 ETH, valued at roughly $7 million at the time, was moved to Tornado Cash in an effort to break the trail of traceability.
Affected Systems
The Nomad bridge was designed to facilitate cross-chain communication between Ethereum and other blockchain networks, including Moonbeam and Evmos. The original exploit exposed fundamental weaknesses in cross-chain messaging protocols, particularly in how transaction proofs are validated and initialized.
The current activity also connects to broader security concerns in the ecosystem. In a related development, funds stolen in the Pancake Bunny flash loan attack from 2021 were also being moved during the same market volatility period. The Pancake Bunny hacker exchanged stolen DAI tokens for ETH, although blockchain investigator Officer CIA noted that 3.6 million DAI was mistakenly sent to a DAI stablecoin address, demonstrating that even sophisticated attackers can make costly errors.
The Mitigation Strategy
Security researchers and blockchain analytics firms have been tracking these fund movements in real time. The use of Tornado Cash, while complicating traceability, does not render tracking impossible. Advanced on-chain analysis tools can still identify patterns and link wallet addresses across mixer transactions.
For protocols still operating cross-chain bridges, the Nomad exploit serves as a critical reminder of the importance of formal verification of smart contract initialization routines. Regular security audits, bug bounty programs, and the implementation of time-locked withdrawal mechanisms can significantly reduce the attack surface for bridge protocols.
Lessons Learned
The reappearance of the Nomad exploiter underscores several key security lessons for the cryptocurrency industry. First, stolen funds remain a persistent threat — hackers can sit on illicit gains for years before moving them. Second, market downturns create unique security dynamics, as threat actors exploit price dislocations to maximize the value of their stolen assets. Third, cross-chain bridge vulnerabilities continue to be one of the most lucrative attack vectors in DeFi, with over $2 billion lost to bridge exploits since 2021.
The Australian Federal Police’s Operation Spincaster, which recently identified over 2,000 Australian-owned crypto wallets compromised through approval phishing tactics, further illustrates the scale of crypto-related crime. According to AFP Detective Superintendent Tim Stainton, the intelligence gathered from the operation revealed new cybercriminal tactics being used to defraud users through deceptive transaction signing.
User Action Required
Cryptocurrency users should take proactive steps to protect their assets. Always verify the smart contracts you interact with, especially when signing approval transactions. Use hardware wallets for storing significant holdings, and consider revoking unnecessary token approvals through tools like Revoke.cash. Stay informed about ongoing security incidents by following reputable blockchain analytics firms and security researchers on social media. If you suspect your wallet has been compromised, immediately transfer remaining funds to a secure address and report the incident to relevant authorities.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before making any financial decisions.
Using stolen DAI to buy discounted ETH two years later. The audacity of this exploiter is something else. At least blockchain is transparent enough to track the movements.
39.75M DAI for 16,892 ETH. dude literally market bought the dip with stolen funds. cant make this up
2 years of silence then suddenly moves 39.75M DAI in one shot. blockchain forensics teams were definitely watching that wallet
16,892 ETH bought at roughly $2,350. that position is probably worth 3x now. crime does pay if you wait long enough apparently
the nomad exploit was one of the messiest ones because copycat attackers joined in after the initial vulnerability was found. the original exploiter actually tried to return some funds
^ yeah the whitehat narrative was wild. the original attacker even left a message on chain saying they wanted to return funds, then went silent for 2 years
the copycat thing was crazy. the vulnerability was so simple that random people just started draining funds too. open season on Nomad
imagine being the original exploiter and watching copycats drain what could have been your 190M. chaos breeds chaos