Many people emptied the Nomad bridge within an hour

Mandiant: about $36 million had been returned

Revision · Mandiant

In a November review, Mandiant wrote the bounty as keeping 10%, with no further pursuit if 90% was returned, plus a white-hat NFT. The article said $36 million of the $190 million was ultimately returned. This site treats that later cumulative figure as the recovery figure. The $22.4 million of August 5 stays in the previous entry.

• Mandiant · Article · Secondary

Early returns were about $22.4 million, with 10% offered as a reward

Revision · Nomad

The Block, using Etherscan, wrote that $22.4 million had been returned as of August 5. That was about 11.7% of $190 million. The team said returners could keep 10%. It said it would not take legal action against people who returned on those terms. This figure was later superseded by a higher cumulative return.

• The Block · Article · Secondary

White hats were asked to return funds to an Anchorage address

Industry · Nomad

Cointelegraph cited Nomad. It asked any white hat or security researcher then holding ETH or ERC-20 tokens moved off the bridge to return the funds to the Anchorage address 0x94A84433101A10aEda762968f6995c574D1bF154. Nomad said it was tracing the funds with TRM Labs and law enforcement.

Nomad asks that any white hat hacker or ethical security researcher currently holding ETH or ERC-20 tokens from the token bridge attack please return them by sending them to the following Anchorage wallet address: 0x94A84433101A10aEda762968f6995c574D1bF154

• Cointelegraph · Article · Secondary

The project acknowledged the incident and notified law enforcement

Confirmation · Nomad

The Register cited a Nomad post. The team was handling the matter. It had notified law enforcement and retained on-chain intelligence and forensics firms. The aim was to identify the accounts involved, and to trace and recover the funds.

We are working around the clock to address the situation and have notified law enforcement and retained leading firms for blockchain intelligence and forensics.

• The Register · Article · Secondary

An upgrade made messages count as already proven by default

Technical · samczsun

The Verge relayed an explanation from Paradigm researcher samczsun. A routine upgrade set the trusted root to an empty value, so messages passed verification by default. After that, someone only had to copy a transaction that had already succeeded, swap in their own address, and broadcast it. The assets would then be sent to them. Only this public feature is recorded here. Call details are not written.

• The Verge · Article · Secondary

More than 300 addresses moved about $190 million

Alert · PeckShield

The Block cited PeckShield. An unnamed address first moved nearly $95 million. After the news spread, others joined. More than 300 addresses moved funds off the bridge in about an hour. Of those, 41 addresses accounted for about $152 million. PeckShield treated at least 6 addresses as white hats. Those moved about $8.2 million. The bridge connects Ethereum, Moonbeam, Evmos, and Avalanche.

• The Block · Article · Secondary