Nomad Bridge Hack: Israel Extradites the Man Accused of Finding the $186M Flaw

Early on Thursday 29 October 2026, Israel handed Alexander Block to the United States. Eighteen months earlier he had been stopped at Ben Gurion Airport near Tel Aviv, holding a passport issued the day before in a surname he had taken the day before that, and waiting for a flight to Russia. Israel's State Attorney's Office announced the transfer after he lost his last appeal at the Supreme Court in Jerusalem.

Block, an Israeli and Russian citizen formerly known as Alexander Gurevich, is wanted in California over the 2022 hack of Nomad, a crypto "bridge". US prosecutors say that, under the online name "Bitlik", he found a flaw in Nomad's code and withdrew about $2.89 million on 1 August 2022. They also say his withdrawals showed others how to do the same, and that others, hundreds of them, then drained about $186 million of other people's money in a few hours. He is charged, not convicted, and is presumed innocent unless proven guilty.

A bridge with a broken lock

Crypto is spread across separate networks, called blockchains, that cannot talk to each other. A coin on one cannot simply be sent to another. A bridge works like a depositary bank issuing American depositary receipts: the original asset is locked up on one network, and a receipt for it, a token (digital voucher), is issued on the other, where it can be traded. Everything rests on one check: has the deposit on the other side really been made?

Nomad ran a bridge between Ethereum, the second-largest crypto network, and several smaller ones such as Moonbeam. The company behind it, Illusory Systems, raised about $22.4 million in 2022 at a $225 million valuation in a round led by the crypto fund Polychain Capital. On 28 July 2022 it named more backers, including Coinbase Ventures, the investment arm of the Coinbase exchange, OpenSea, a marketplace for digital collectibles, Crypto.com Capital and Polygon. It marketed itself as "security-first".

In June 2022, after an outside security audit, Nomad updated the code that ran the bridge. The bridge is a smart contract: code that moves money by itself, with no clerk to stop it. The update set a key value to zero, and because of that every withdrawal request counted as already checked. It was like a cloakroom where the attendant accepts any ticket, even a blank one, and hands over whatever coat is named on it.

The copy-paste robbery

On 1 August 2022, the bridge began to empty. Every transaction on Ethereum is public, so once one withdrawal worked, anyone could look it up, copy it, swap in their own wallet address and send it again. No programming skill was needed. Samczsun, a security researcher at the investment firm Paradigm, called it "one of the most chaotic hacks that Web3 has ever seen".

Strangers piled in. The crypto exchange Coinbase later found that about 88% of the addresses that took part were copycats, and that they took about $88 million between them. The news site The Block put the number of people involved at about 300. A few early wallets took tens of millions each. By the time Nomad's team could react, the bridge held almost nothing. The loss was reported at about $190 million at the time; the US Federal Trade Commission (FTC) later put it at $186 million.

Some of the copycats were what the industry calls white hats: people who grab money from a leaking project to keep it safe and hand it back. Nomad offered everyone a deal: return 90% and keep 10% as a reward, with no legal action. More than $22 million came back within days. The FTC later said white hats had secured at least $37 million.

What prosecutors say "Bitlik" did

The US case was set out in an extradition request sent to Israel on 10 December 2024 and described in the Israeli court rulings. Prosecutors say Block spotted the flaw in late July 2022, made six test transfers, and then, around 1 August, made four main transfers. The bridge issued him tokens worth more than $2.8 million without any matching deposit. Reports of the request put the figure at about $2.89 million. He then allegedly swapped the tokens for other cryptocurrencies and moved them through several wallets to hide where they came from.

His transfers, prosecutors say, exposed the flaw to everyone else. They do not accuse him of taking the $186 million himself. Their case is that he opened the door.

A few days later, according to the request, he sent back some tokens, about $162,000 worth according to reports, to a recovery wallet Nomad had set up. Then, using a false identity, he messaged Nomad's chief technology officer, James Prestwich, on the messaging app Telegram. He apologised for the trouble and offered to return the rest in exchange for a reward for finding the flaw. He asked for $500,000. Nomad offered 10%, the same reward it had offered everyone. He said he would consult a lawyer, then stopped answering. Nomad went to US law enforcement.

A federal grand jury in the Northern District of California, which covers San Francisco, indicted him on 16 August 2023 on eight counts: four of computer fraud, one of transporting stolen property and three of money laundering. Each money laundering count carries up to 20 years in prison.

A new surname and a flight to Russia

Israeli reports say Block came back to Israel on 19 April 2025 and was summoned to the Jerusalem District Court for an extradition hearing. On 29 April he changed his surname from Gurevich to Block at Israel's Population Registry. On 30 April he was issued a passport in his new name at the airport. On 1 May he was arrested at Ben Gurion while waiting to board a flight to Russia. Prosecutors asked the court to declare him extraditable the next day.

On 14 July 2025, the Jerusalem District Court, Judge Ohad Gordon presiding, ruled that he could be extradited. Block appealed. His lawyers argued that he had only used functions that Nomad's own automated system offered, so there was no break-in, and that crypto transfers are public, so nothing had been hidden and there was no laundering.

A panel of three Supreme Court justices, Ofer Grosskopf, Khaled Kabub and Yechiel Kasher, heard the appeal on 22 January 2026 and rejected it on 8 March. The court ruled that exploiting a programming error or a security flaw can be unlawful entry into a computer even if the software technically allows the action. It also ruled that a public blockchain does not rule out laundering, because the record shows wallets, not the people behind them. Supreme Court President Isaac Amit later refused his request for a further hearing. Attorney Avi Kronenberg of the State Attorney's international department handled the case, and the handover was coordinated with the Israel Police's Interpol unit.

The code allowed it

Block's defence is a familiar one in crypto: if the code let me do it, it was not theft. Andean Medjedovic, a Canadian charged in New York over about $65 million taken from Indexed Finance and KyberSwap, has said through lobbyists that he merely traded. Jonathan Spalletta, who drained Uranium Finance through a flaw in its reward code, was convicted by a Manhattan jury in October 2026. Israel's Supreme Court has now given its own answer, at least for extradition: a flaw is not permission.

The case in California will test the same argument on the facts. As of 31 October 2026, the US Justice Department had not announced a court date, and no plea had been reported.