The Nomad cross-chain bridge has suffered an exploit resulting in a large number of malicious 'copy/paste' actors draining the protocol’s collateral.
Researchers shared a tweet in the ETHSecurity Telegram channel showing multiple transactions of funds leaving the bridge. At first glance, it appeared to be a misconfiguration in token decimals, but samczsun discovered:“However, after some painful manual digging on the Moonbeam network, I confirmed that while the Moonbeam transaction did bridge out 0.01 WBTC, somehow the Ethereum transaction bridged in 100 WBTC.
What makes this exploit different is that the transactions were not ‘proved’ and executed directly. “Being able to process a message without proving it first is extremely Not Good,” said samczsun. The coder did some more digging and found a fatal flaw in the ‘Replica’ smart contract initialized during a routine Nomad upgrade.
He added that this was chaotic because the crypto thieves did not need any technical knowledge. They just needed to find a transaction that worked, replace the target address with their own, and rebroadcast it. “A routine upgrade marked the zero hash as a valid root, which had the effect of allowing messages to be spoofed on Nomad. Attackers abused this to copy/paste transactions and quickly drained the bridge in a frenzied free-for-all,”Nomad has even discovered fraudulent addresses attempting to steal funds returned to the bridge.
We’re aware of impersonators posing as Nomad and providing fraudulent addresses to collect funds. We aren’t yet providing instructions to return bridge funds. Disregard comms from all channels other than Nomad’s official channel:
Malaysia Latest News, Malaysia Headlines
Similar News:You can also read news stories similar to this one that we have collected from other news sources.
Nomad Bridge Drained of Nearly $200M in Exploit.nomadxyz_ pitched itself as a 'secure' alternative to other cross-chain bridges. On Monday, it was drained completely. How did Nomad lose $200 million? skesslr reports
Read more »
Ariel Nomad R 2022 review | EvoAriel’s latest creation aims to blend the Atom’s road and track chutzpah with the Nomad’s off-road ability. So does the 335bhp Nomad R offer the best of both worlds?
Read more »
Star Trek Star William Shatner Remembers Late Co-Star Nichelle NicholsThe Star Trek family and entertainment industry as a whole suffered a massive loss this weekend, [...]
Read more »
Nomad Bridge Drained of Nearly $200M in Exploit.nomadxyz_ pitched itself as a 'secure' alternative to other cross-chain bridges. On Monday, it was drained completely. How did Nomad lose $200 million? skesslr reports
Read more »
Edmonds man arrested after admitting to murdering wifeWhen officers arrived, they found a “chaotic” scene.
Read more »