Leaderboard
26All-time rank
Nomad
Aug 1, 2022
$190M
Lost
$190M
Recovered
$0
Net loss
$190M
Unrecovered0% recovered
On August 1, 2022, Nomad bridge was exploited when the protocol initialization set trusted roots to 0x00, matching the untrusted root value. This caused the Replica contract to accept any messages as valid, enabling 300+ copycat attackers to drain $190M total.
How the exploit worked
View reproducible PoCBusiness Logic Flaw : Incorrect acceptable merkle-root checks.
Lost: Multiple ERC-20 Tokens (~152M US$)
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- Bridge
- Classification
- Bridge & Cross-Chain
- Technique
- Forged Proof
- Attribution
- North Korea
- Chains
Ethereum
Event timeline
- Aug 1, 2022Exploit executed — $190M drained via forged proof
- Attributed to North Korea
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)