regulation ·
Israel Extradites Alleged Nomad Bridge Exploiter to US Over $2.8M Theft: Report
The Israeli Supreme Court determined that exploiting a flaw in code constitutes computer intrusion, even if the software itself permitted the transaction.
Israel's State Attorney's Office announced on Thursday, as detailed in The Jerusalem Post, that an Israeli-Russian national has been sent to the United States to face charges related to an alleged theft of approximately $2.8 million from the Nomad crypto bridge.
Alexander Block, whose former name was Alexander Gurevich, was transferred to U.S. authorities early Thursday subsequent to his appeals being unsuccessful within Israel. He was detained at Ben Gurion Airport in May 2025 while he was preparing to travel to Russia, shortly after he had changed his surname and acquired a passport under his new name.
In August 2023, a federal grand jury in the Northern District of California formally indicted Block on four counts of computer fraud, three counts of money laundering, and one count of transporting stolen property, according to the Supreme Court's ruling in the case. The U.S. formally requested his extradition in December 2024.
The judgment outlines that a software update in June 2022 introduced a vulnerability within Nomad's smart contracts, allowing users to receive tokens on one blockchain without simultaneously locking the equivalent assets on another. Block, using the handle "Bitlik," allegedly executed six preliminary transfers before conducting four principal transfers around August 1, 2022, thereby obtaining tokens valued at upwards of $2.8 million. Subsequently, he is accused of moving these tokens through various wallets and converting them into different cryptocurrencies to obscure their source.
The request further alleges that his actions revealed this vulnerability to other Nomad participants, who subsequently depleted a Nomad-managed wallet containing over $186 million in user assets. A few days following the incident, Block returned some of the tokens and contacted a high-ranking Nomad official via Telegram, proposing to return the remainder in exchange for payment for discovering the flaw. He later ceased communication, prompting Nomad to involve U.S. law enforcement.
The Jerusalem District Court granted Block's extradition in July 2025. On appeal, his defense contended that the transactions utilized functions already available within Nomad's automated system, and furthermore, that the publicly available record of blockchain transfers invalidated the money laundering accusations. However, the Supreme Court dismissed both of these arguments, asserting that exploiting a programming defect can be regarded as unlawful computer intrusion even when the software technically permitted the action, as reported by The Jerusalem Post. The court also determined that transactions visible to the public do not inherently identify the individuals controlling the wallets nor negate attempts to hide the origin of funds.
Supreme Court President Isaac Amit subsequently denied Block's petition for an additional hearing, according to the State Attorney's Office.
The exploit in August 2022 resulted in Nomad losing almost all of its available funds. At the time, Paradigm researcher Sam Sun compared the ensuing chaos to "a frenzied free-for-all," as Decrypt reported.
In December 2025, the Federal Trade Commission put forth a settlement agreement with Illusory Systems, the operator of Nomad, stating that the bridge suffered an $186 million loss after hackers took advantage of a software update that was inadequately tested. This settlement mandates that the company must return any recovered funds to users who have not yet received reimbursement. Nomad managed to recoup approximately $22 million in the days immediately following the hack.
Earlier coverage
Reported by Decrypt.
