The exploit took place due to a smart contract vulnerability that saw hundreds of users other than the hacker also get involved, taking away as much as they can by simply copy-pasting the transaction data used by the initial hacker and changing the wallet address to theirs. The event was later deemed as a decentralized robbery by many due to the involvement of normal community members.
Later, the Nomad team revealed to Cointelegraph that some of the people who took funds were acting benevolently to protect the crypto from getting into the wrong hands.
In the aftermath of the hack, the crypto analysis group BestBrokers found that the first exploit took place on Aug. 1, which drained 400 Bitcoin (BTC) in four different transactions. The hackers later diverted all 22,880 Ether (ETH), then moved on to the over $107 million worth of stablecoins and finally started diverting the altcoins supported by the project.
The incident has seen WBTC, Wrapped Ether (WETH), USD Coin (USDC), Frax (FRAX), Covalent Query Token (CQT), Hummingbird Governance Token (HBOT), IAGON (IAG), Dai (DAI), GeroWallet (GERO), Card Starter (CARDS), Saddle DAO (SDL) and Charli3 (C3) tokens taken from the bridge.
Related: Ongoing Solana-based wallet hack seeing millions drained
Some altcoins that were stolen from the platform suffered as much as a 94% decline. Data collected by the analysis firm showed that the following altcoins suffered the biggest collapse after the hack:
The smart contract vulnerability that was exploited was highlighted in a security audit report done by Quantstamp in the first week of June. The Nomad team even responded to the vulnerability by claiming it to be "effectively impossible to find the preimage of the empty leaf.”
The auditors believed that the Nomad team has misunderstood the issue at the time, and within two months, the same vulnerability has been the reason behind nearly $200 million in losses.
The Nomad token bridge hack on Aug. 3 was the fourth largest crypto hack in history that saw nearly $200 million worth of crypto assets drained from the platform. However, more than the hack, the methodology behind it garnered widespread attention.
Cointelegraph reached out to Nomad with queries related to the discovery and will update the story accordingly.
North Gyeongsang Province seized $890,000 in crypto from residents who failed to pay taxes. The province aims to recover $136 million in unpaid taxes by the end of the year, using aggressive measures against tax evaders.
AnaisBlockchain security firm SlowMist warns of rising scams using fake trading bots that falsely claim ties to OpenAI’s ChatGPT. These schemes lure users into investing, only for their funds to disappear. Exercise caution and avoid suspicious links and unverified code.
CatherineHTX has partnered with TradingView to allow users to trade cryptocurrencies directly within the TradingView platform, enhancing the trading experience. This integration provides users with easier access to HTX's services and resources, enabling more efficient and flexible trading strategies.
AnaisHong Kong police dismantled a fraud syndicate that used deepfake technology to scam individuals out of approximately HK$360 million (around $46 million) through romance scams. A total of 27 suspects were arrested, including five believed to have ties to organised crime, highlighting the growing threat of sophisticated online scams.
Joy
AlexTikTok is under UK scrutiny for allegedly operating as an unlicensed crypto exchange, raising concerns about financial regulation. This mirrors recent actions against platforms like Telegram, sparking questions about whether more social media apps will face similar scrutiny.
Catherine
MiyukiDonald Trump’s WLFI token sale raised $9 million, far short of its $300 million target, amidst website crashes and technical issues. With delayed support from Trump and access limited to accredited investors, scepticism grows over the project’s chances of recovery.
KikyoPhishing attacks targeting Ledger users are on the rise, with scammers sending fake emails about a nonexistent security feature called "Ledger Clear Signing." These emails urge users to provide sensitive information, putting their cryptocurrency at risk.
Anais
Weiliang