Nomad Bridge Hacked for $200 Million: What Will be the Consequences?

On the evening of August 1st, the Nomad Bridge was exploited and almost the entirety of the bridge’s $200 million was siphoned by malicious hackers. This is the fourth significant bridge hack of the year and brings the total value lost in bridge hacks to over $1 billion for 2022. Let’s take a look at some of the impacted blockchains and applications related to this specific hack.

Nomad launched earlier this year and serves as the primary bridge for the Evmos and Moonbeam blockchains, but also has a presence on Ethereum, Avalanche, and Milkomeda C1. It had strong venture backing and recently announced that they raised $22.5 million in funding from some of the biggest names in the space, including Coinbase, Polygon, OpenSea, and Crypto.com. Generally, they were well-regarded and had no issues with hacks or thefts before August 1st. Additionally, they were audited by Quantstamp, one of the leading blockchain and smart contract auditors, in June 2022.

During this bull market, and as the total value of Evmos and Moonbeam has risen, Nomad reached a high of almost $200 million total value locked in late July.
Like other bridges, Nomad works by taking an asset that will be bridged from one chain to another, locking it in a smart contract on its native chain, and sending the user a “bridged” version of the asset on another chain. For example, Nomad allowed users to receive ETH.mad on Moonbeam in exchange for real Ethereum locked on the Ethereum mainnet.
The exploit that the hacker used, according to the limited information currently available, was relatively simple and it is surprising that it was not found earlier. Essentially, when a user passed funds from one blockchain to another, Nomad never checked to confirm if the amount that a user would receive was the same as the amount they bridged. So a user could bridge .1 ETH, then manually call the smart contract on the other blockchain and tell it that it was receiving 100 ETH.
After the hack, Moonbeam paused its blockchain, preventing anyone from making transactions or interacting with smart contracts. A massive amount of the DeFi activity on Moonbeam takes place using assets from the Nomad bridge, and this could be catastrophic for the entire Moonbeam ecosystem if not handled properly. During the writing of this article, the blockchain was resumed and, as expected, everyone dumped their Nomad-backed assets as fast as possible. This could either cause the price of GLMR, the native Moonbeam token, to rise significantly as people sell their worthless assets for it, or fall into oblivion as people completely abandon Moonbeam.

Additionally, the centralization demonstrated by Moonbeam, while arguably helpful, will certainly taint the blockchain’s reputation as “decentralized” and “trustless.”
Evmos, which did not pause its chain, saw the EVMOS token pump significantly as users sold their Nomad-backed assets for the blockchain’s native asset. Whether this will last remains to be seen, but it is likely that EVMOS falls back to its original price or lower as people leave the ecosystem.

It is unknown at the moment how Nomad will respond or if they will try to compensate users who lost funds.Overall, the Nomad hack will most negatively impact the Evmos and Moonbeam blockchains, but its aftershocks will be felt across the entire market. Users will become more suspicious of bridges, the price of top assets could drop if the hacker tries to sell them, and more scrutiny will be brought upon the space by regulators. Even though this is an unforeseen and unfortunate incident, it will likely not lead to any major consequences in the space in the long-term.