'Copycats' Stole $88M During Nomad Exploit by Copying Attacker's Code: Coinbase

Over 88% of the addresses involved in the $190 million Nomad attack likely belonged to users copying a code that was initially used by the exploiters.

AccessTimeIconAug 11, 2022 at 8:45 a.m. UTC
Updated May 11, 2023 at 6:42 p.m. UTC

Some 88% of the exploiters behind Nomad’s bridge attack were likely those who merely copied the key attacker’s code and executed their own attack, new research from crypto exchange Coinbase (COIN) estimated this week.

Nomad, a cross-chain bridge that allowed users to send and receive tokens between different blockchains, was exploited in early August for over $190 million, or about the entirety of its token reserves.

The Coinbase research shows some 88% of all addresses that conducted the exploit were identified as “copycats” that together stole about $88 million in tokens from the bridge.

“The majority of copycats used a variation of the original exploit by simply modifying targeted tokens, amounts and recipient addresses,” Coinbase researchers said.

“While the majority of valuable tokens were claimed by just two of the original exploiters’ addresses, hundreds of others were able to claim part of the bridge’s holdings,” the researchers added.

Nomad did not return requests for comment at press time.

Two addresses stole a majority of the funds from Nomad amid "hundreds" of other copycats. (Coinbase)
Two addresses stole a majority of the funds from Nomad amid "hundreds" of other copycats. (Coinbase)

On Twitter, Paradigm researcher @samczsun explained that a recent update of one of Nomad’s smart contracts made it easy for users to spoof transactions, as previously reported.

This meant users were able to withdraw money from the Nomad bridge that didn’t actually belong to them. And unlike some bridge attacks, where a single culprit is behind the entire exploit, the Nomad attack was a free-for-all.

“... [Y]ou didn't need to know about Solidity or Merkle Trees or anything like that. All you had to do was find a transaction that worked, find/replace the other person's address with yours, and then re-broadcast it,” @samczsun said in a tweet in early August.

Such a scenario allowed early observers of the exploit to merely copy the attacker’s code, add their addresses and broadcast the changed code to the network in order to steal funds from Nomad.

This also caused the original exploiters “to compete against hundreds of copycats” for their attack, the Coinbase researchers pointed out.

Meanwhile, Nomad is currently working with security agencies and ethical hackers to recover part of the stolen funds and launched a bounty program last week. Over $25 million in funds have been returned as of Aug. 10, but most of it remains missing.


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by Block.one; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

Shaurya Malwa

Shaurya is the Deputy Managing Editor for the Data & Tokens team, focusing on decentralized finance, markets, on-chain data, and governance across all major and minor blockchains.

Read more about