Cross-chain messaging protocol Nomad has become the target of crypto’s latest nine-figure attack after hackers abused a “chaotic” security exploit to steal almost $200 million in digital assets.
Nomad, a token bridge that allows users to send and receive tokens between Avalanche (AVAX), Ethereum (ETH), Evmos (EVMOS), Moonbeam (GLMR) and Milkomeda C1 blockchains, was attacked on Monday, with hackers draining almost all of the protocol’s funds.
Approximately $190.7 million in crypto was stolen from the bridge, according to decentralized finance tracking platform DeFi Llama, which shows that the current total value locked — the amount of user funds deposited in a DeFi protocol — is less than $12,000 at the time of writing.
Nomad has yet to confirm how hackers were able to steal the funds. But according to samczsun, the head of security at web3 investment firm Paradigm, a recent update to one of Nomad’s smart contracts made it easy for users to spoof transactions. This meant that when a user transferred funds from one blockchain to another, Nomad allegedly never checked the amount, enabling the user to withdraw funds didn’t that didn’t belong to them. For example, a user could send 1 ETH, for example, and then manually call the smart contract on the other blockchain to receive 100 ETH. Blockchain audit company Zellic also came to the same conclusion.
“It’s like using a checkbook to withdraw funds from a bank, and the bank doesn’t verify if we actually hold enough money,” Adrian Hetman, tech lead of the triaging team at web3 bug bounty program Immunefi, told TechCrunch. “They only care that the check itself looks valid.”
Samczun explains that, unlike most bridge attacks where a single culprit is behind the entire exploit, the “chaotic” Nomad attack was a free for all whereby opportunists flocked to steal funds from the bridge once word had got around, resulting in what the researcher described as a “frenzied free-for-all.” Blockchain security firm Peckshield said more than 41 addresses drained $152 million — or 80% of the stolen funds.
“All that was required to exploit it was to copy the original hacker’s transaction and change the original address to a custom one. Simple copy-paste,” Hetman added.
The incident affected Wrapped Ether (WETH), USD Coin (USDC), WBTC and other tokens that were drained from the bridge.
TechCrunch contacted Nomad but has yet to receive a response. However, the company took to Twitter to warn about impersonators trying to collect funds. “We’re aware of impersonators posing as Nomad and providing fraudulent addresses to collect funds,” it said. “We aren’t yet providing instructions to return bridge funds. Disregard comms from all channels other than Nomad’s official channel.”
In a separate tweet, Nomad confirmed it has notified law enforcement …read more
https://techcrunch.com/2022/08/02/nomad-chaotic-exploit-crypto/