Nomad Bridge hack
The Nomad token bridge was drained of about $190M in August 2022 in a chaotic 'free-for-all' after a flawed upgrade let users replay other people's withdrawal messages by copying transactions.
Also known as: Nomad, Nomad Bridge
Summary
Nomad was a cross-chain token bridge. In August 2022 a flawed smart-contract upgrade effectively treated unverified messages as valid, allowing anyone to drain funds by copying an exploiter's transaction and substituting their own address. The result was a chaotic "free-for-all" in which hundreds of addresses participated, draining roughly $190 million. [1][2]
Aftermath
Nomad asked participants to return funds, designated a recovery wallet, and offered to treat those who returned at least 90% as "white hats"; a portion of the funds was recovered. [1][2]
Bracketed numbers refer to the numbered sources listed below.
Sources (2)
See also
World Liberty Financial (WLFI) — Justin Sun token freezeProjectsWLFI, a DeFi project linked to Donald Trump and his family, blacklisted/froze the wallet of major investor Justin Sun in Sept 2025 — ~540–595M unlocked WLFI tokens (~$107M) plus ~2.4B locked. Sun sued, alleging an undisclosed admin 'blacklist backdoor'; WLFI denied it and threatened a countersuit. The dispute is ongoing.
Gala Games exploitTokensOn May 20, 2024 an attacker abused a privileged minter account on the GALA token contract to mint 5 billion GALA (≈$200M+ nominal) and dumped ~600M of them for ~$22M of ETH before Gala froze the address. Gala Games called it an internal access-control failure; the attacker later returned the ~$22M.
This page was last updated on Jun 15, 2026. View revision history.
