{"id":227,"date":"2022-08-03T01:04:02","date_gmt":"2022-08-02T17:04:02","guid":{"rendered":"https:\/\/www.maplabs.io\/blog\/?p=227"},"modified":"2022-08-03T01:12:41","modified_gmt":"2022-08-02T17:12:41","slug":"nomad-bridge-hack-explained","status":"publish","type":"post","link":"https:\/\/www.mapprotocol.io\/blog\/nomad-bridge-hack-explained\/","title":{"rendered":"Nomad Bridge Hack Explained"},"content":{"rendered":"\n

According to CertiK Alert<\/a>, the cross-chain bridge Nomand Bridge has been hacked on this Monday, with losses over $190 million. The Nomand team<\/a> soon acknowledged this exploit and stated that \u201cwe are currently looking into the incident and will provide updates when they have them.\u201d<\/p>\n\n\n

\n
\"nomad
Nomad Tweet<\/figcaption><\/figure><\/div>\n\n\n

What Happened Exactly?<\/h2>\n\n\n\n

Usually, a cross-chain bridge works by \u201cwrapping\u201d tokens in a smart contract and then issuing native assets users can use on another chain. If the smart contract gets exploited, the wrapped tokens would lose backing and become worthless, and this is where Nomand Bridge went wrong.<\/p>\n\n\n\n

The Nomad team recently made an update to one of its smart contracts, which made it easy for users to spoof transactions. This means users were able to withdraw money that did not belong to them from Nomand Bridge.<\/p>\n\n\n\n

Unlike previous cross-chain bridge attacks \u2013 Ronin<\/a> ($624m), Wormhole<\/a>($326m), Harmony<\/a>($100m),  QBridge<\/a>($80m) where there may be a single culprit behind the looting, the Nomad attack is rather chaotic. Due to its loophole in smart contract, all it takes is to \u201cfind a transaction that worked, find\/replace the other person’s address with yours, and then re-broadcast it.\u201d<\/p>\n\n\n\n

A Deeper Dive into Nomad\u2019s Cross-Bridge Design<\/h2>\n\n\n\n

The Nomad team could have avoided this attack. However, early this year in February, they stated<\/a> that they gave up light clients<\/strong> in Nomad\u2019s design because of technical difficulties of implementing light clients. This means that they would forgo security in exchange of lower operating costs and simplicity. And now that decision costs them $190 million.<\/p>\n\n\n

\n
\"Nomad
From Nomad Medium post on Feb 8 2022.<\/figcaption><\/figure><\/div>\n\n\n

If they had implemented Light Client in the first place, this attack could possibly be avoided, as Light Client is the only decentralized cross-chain technology with 100% security. Nomad’s tragedy is another wake-up call for those who favor simplicity over security.<\/p>\n\n\n\n

Developing and deploying the Light Client is not a \u201clight\u201d task. As the industry leading omichain infrastructure builder,  MAP invested full-stack development effort with over 20 experienced engineers for almost four years, and finally it will go live at the end of this month. MAP Protocol chooses Light Client in the beginning and we keep our nose to the grindstone to make it happen. Cross-chain security is the heart and soul of MAP Protocol.<\/p>\n\n\n\n

Of course, the loophole in Nomad\u2019s smart contract is to blame for this attack. Essentially, any service provider should thoroughly audit its services before it goes alive. As in our case, we conduct triple code test cases, hashed timelock, and engaged third-party professional auditors like Certik for extra assurance.<\/p>\n\n\n\n

How Nomad Can Restore its Security and Confidence<\/h2>\n\n\n\n

For restoring security and confidence, Nomad team really should consider to go back to Light Client technology.  MAP Protocol highly welcomes Nomad to replace their current solution and rebuild on MAP\u2019s infrastructure built upon Light Client technology. We will support Nomad in all technical aspect possible regarding light-client implementation. Smart contract management will also be another key piece for restoring security. It would be helpful if they follow more strict security practices \u2013 conduct triple code test cases, add hashed timelock every time before they go live, and engage more professional auditors.<\/p>\n\n\n\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

According to CertiK Alert, the cross-chain bridge Nomand Bridge has been hacked on this Monday, with losses over $190 million. The Nomand team soon acknowledged this exploit and stated that \u201cwe are currently…<\/p>\n","protected":false},"author":2,"featured_media":228,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[3],"tags":[51],"yoast_head":"\nNomad Bridge Hack Explained - Map Protocol Blog<\/title>\n<meta name=\"description\" content=\"According to CertiK Alert, the cross-chain bridge Nomand Bridge has been hacked on this Monday, with losses over $190 million.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.mapprotocol.io\/blog\/nomad-bridge-hack-explained\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Nomad Bridge Hack Explained - Map Protocol Blog\" \/>\n<meta property=\"og:description\" content=\"According to CertiK Alert, the cross-chain bridge Nomand Bridge has been hacked on this Monday, with losses over $190 million.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mapprotocol.io\/blog\/nomad-bridge-hack-explained\/\" \/>\n<meta property=\"og:site_name\" content=\"Map Protocol Blog\" \/>\n<meta property=\"article:published_time\" content=\"2022-08-02T17:04:02+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-08-02T17:12:41+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mapprotocol.io\/blog\/wp-content\/uploads\/2022\/08\/nomad-bridge-statistics.png\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"416\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@MapProtocol\" \/>\n<meta name=\"twitter:site\" content=\"@MapProtocol\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"mackyclyde\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mapprotocol.io\/blog\/#organization\",\"name\":\"Map Protocol\",\"url\":\"https:\/\/www.mapprotocol.io\/blog\/\",\"sameAs\":[\"https:\/\/t.me\/MAPprotocol\",\"https:\/\/open.kakao.com\/o\/gP9WduRb\",\"https:\/\/twitter.com\/MapProtocol\"],\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mapprotocol.io\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.maplabs.io\/blog\/wp-content\/uploads\/2022\/06\/\u9ed1-\u7ad6\u7248.png\",\"contentUrl\":\"https:\/\/www.maplabs.io\/blog\/wp-content\/uploads\/2022\/06\/\u9ed1-\u7ad6\u7248.png\",\"width\":572,\"height\":246,\"caption\":\"Map Protocol\"},\"image\":{\"@id\":\"https:\/\/www.mapprotocol.io\/blog\/#\/schema\/logo\/image\/\"}},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mapprotocol.io\/blog\/#website\",\"url\":\"https:\/\/www.mapprotocol.io\/blog\/\",\"name\":\"Map Protocol Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/www.mapprotocol.io\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mapprotocol.io\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mapprotocol.io\/blog\/nomad-bridge-hack-explained\/#primaryimage\",\"url\":\"https:\/\/www.mapprotocol.io\/blog\/wp-content\/uploads\/2022\/08\/nomad-bridge-statistics.png\",\"contentUrl\":\"https:\/\/www.mapprotocol.io\/blog\/wp-content\/uploads\/2022\/08\/nomad-bridge-statistics.png\",\"width\":800,\"height\":416,\"caption\":\"nomad bridge statistics\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mapprotocol.io\/blog\/nomad-bridge-hack-explained\/#webpage\",\"url\":\"https:\/\/www.mapprotocol.io\/blog\/nomad-bridge-hack-explained\/\",\"name\":\"Nomad Bridge Hack Explained - Map Protocol Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mapprotocol.io\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mapprotocol.io\/blog\/nomad-bridge-hack-explained\/#primaryimage\"},\"datePublished\":\"2022-08-02T17:04:02+00:00\",\"dateModified\":\"2022-08-02T17:12:41+00:00\",\"description\":\"According to CertiK Alert, the cross-chain bridge Nomand Bridge has been hacked on this Monday, with losses over $190 million.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mapprotocol.io\/blog\/nomad-bridge-hack-explained\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mapprotocol.io\/blog\/nomad-bridge-hack-explained\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mapprotocol.io\/blog\/nomad-bridge-hack-explained\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.mapprotocol.io\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Nomad Bridge Hack Explained\"}]},{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mapprotocol.io\/blog\/nomad-bridge-hack-explained\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mapprotocol.io\/blog\/nomad-bridge-hack-explained\/#webpage\"},\"author\":{\"@id\":\"https:\/\/www.mapprotocol.io\/blog\/#\/schema\/person\/ae08472657d53502958a80485ee882af\"},\"headline\":\"Nomad Bridge Hack Explained\",\"datePublished\":\"2022-08-02T17:04:02+00:00\",\"dateModified\":\"2022-08-02T17:12:41+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mapprotocol.io\/blog\/nomad-bridge-hack-explained\/#webpage\"},\"wordCount\":546,\"publisher\":{\"@id\":\"https:\/\/www.mapprotocol.io\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mapprotocol.io\/blog\/nomad-bridge-hack-explained\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.mapprotocol.io\/blog\/wp-content\/uploads\/2022\/08\/nomad-bridge-statistics.png\",\"keywords\":[\"nomad bridge\"],\"articleSection\":[\"MAP News\"],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mapprotocol.io\/blog\/#\/schema\/person\/ae08472657d53502958a80485ee882af\",\"name\":\"mackyclyde\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mapprotocol.io\/blog\/#\/schema\/person\/image\/\",\"url\":\"http:\/\/2.gravatar.com\/avatar\/80b7a6910f5568a1312a460c8402b0fb?s=96&d=mm&r=g\",\"contentUrl\":\"http:\/\/2.gravatar.com\/avatar\/80b7a6910f5568a1312a460c8402b0fb?s=96&d=mm&r=g\",\"caption\":\"mackyclyde\"},\"url\":\"https:\/\/www.mapprotocol.io\/blog\/author\/mackyclyde\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Nomad Bridge Hack Explained - Map Protocol Blog","description":"According to CertiK Alert, the cross-chain bridge Nomand Bridge has been hacked on this Monday, with losses over $190 million.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.mapprotocol.io\/blog\/nomad-bridge-hack-explained\/","og_locale":"en_US","og_type":"article","og_title":"Nomad Bridge Hack Explained - Map Protocol Blog","og_description":"According to CertiK Alert, the cross-chain bridge Nomand Bridge has been hacked on this Monday, with losses over $190 million.","og_url":"https:\/\/www.mapprotocol.io\/blog\/nomad-bridge-hack-explained\/","og_site_name":"Map Protocol Blog","article_published_time":"2022-08-02T17:04:02+00:00","article_modified_time":"2022-08-02T17:12:41+00:00","og_image":[{"width":800,"height":416,"url":"https:\/\/www.mapprotocol.io\/blog\/wp-content\/uploads\/2022\/08\/nomad-bridge-statistics.png","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_creator":"@MapProtocol","twitter_site":"@MapProtocol","twitter_misc":{"Written by":"mackyclyde","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Organization","@id":"https:\/\/www.mapprotocol.io\/blog\/#organization","name":"Map Protocol","url":"https:\/\/www.mapprotocol.io\/blog\/","sameAs":["https:\/\/t.me\/MAPprotocol","https:\/\/open.kakao.com\/o\/gP9WduRb","https:\/\/twitter.com\/MapProtocol"],"logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mapprotocol.io\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.maplabs.io\/blog\/wp-content\/uploads\/2022\/06\/\u9ed1-\u7ad6\u7248.png","contentUrl":"https:\/\/www.maplabs.io\/blog\/wp-content\/uploads\/2022\/06\/\u9ed1-\u7ad6\u7248.png","width":572,"height":246,"caption":"Map Protocol"},"image":{"@id":"https:\/\/www.mapprotocol.io\/blog\/#\/schema\/logo\/image\/"}},{"@type":"WebSite","@id":"https:\/\/www.mapprotocol.io\/blog\/#website","url":"https:\/\/www.mapprotocol.io\/blog\/","name":"Map Protocol Blog","description":"","publisher":{"@id":"https:\/\/www.mapprotocol.io\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mapprotocol.io\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mapprotocol.io\/blog\/nomad-bridge-hack-explained\/#primaryimage","url":"https:\/\/www.mapprotocol.io\/blog\/wp-content\/uploads\/2022\/08\/nomad-bridge-statistics.png","contentUrl":"https:\/\/www.mapprotocol.io\/blog\/wp-content\/uploads\/2022\/08\/nomad-bridge-statistics.png","width":800,"height":416,"caption":"nomad bridge statistics"},{"@type":"WebPage","@id":"https:\/\/www.mapprotocol.io\/blog\/nomad-bridge-hack-explained\/#webpage","url":"https:\/\/www.mapprotocol.io\/blog\/nomad-bridge-hack-explained\/","name":"Nomad Bridge Hack Explained - Map Protocol Blog","isPartOf":{"@id":"https:\/\/www.mapprotocol.io\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mapprotocol.io\/blog\/nomad-bridge-hack-explained\/#primaryimage"},"datePublished":"2022-08-02T17:04:02+00:00","dateModified":"2022-08-02T17:12:41+00:00","description":"According to CertiK Alert, the cross-chain bridge Nomand Bridge has been hacked on this Monday, with losses over $190 million.","breadcrumb":{"@id":"https:\/\/www.mapprotocol.io\/blog\/nomad-bridge-hack-explained\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mapprotocol.io\/blog\/nomad-bridge-hack-explained\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.mapprotocol.io\/blog\/nomad-bridge-hack-explained\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.mapprotocol.io\/blog\/"},{"@type":"ListItem","position":2,"name":"Nomad Bridge Hack Explained"}]},{"@type":"Article","@id":"https:\/\/www.mapprotocol.io\/blog\/nomad-bridge-hack-explained\/#article","isPartOf":{"@id":"https:\/\/www.mapprotocol.io\/blog\/nomad-bridge-hack-explained\/#webpage"},"author":{"@id":"https:\/\/www.mapprotocol.io\/blog\/#\/schema\/person\/ae08472657d53502958a80485ee882af"},"headline":"Nomad Bridge Hack Explained","datePublished":"2022-08-02T17:04:02+00:00","dateModified":"2022-08-02T17:12:41+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mapprotocol.io\/blog\/nomad-bridge-hack-explained\/#webpage"},"wordCount":546,"publisher":{"@id":"https:\/\/www.mapprotocol.io\/blog\/#organization"},"image":{"@id":"https:\/\/www.mapprotocol.io\/blog\/nomad-bridge-hack-explained\/#primaryimage"},"thumbnailUrl":"https:\/\/www.mapprotocol.io\/blog\/wp-content\/uploads\/2022\/08\/nomad-bridge-statistics.png","keywords":["nomad bridge"],"articleSection":["MAP News"],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.mapprotocol.io\/blog\/#\/schema\/person\/ae08472657d53502958a80485ee882af","name":"mackyclyde","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mapprotocol.io\/blog\/#\/schema\/person\/image\/","url":"http:\/\/2.gravatar.com\/avatar\/80b7a6910f5568a1312a460c8402b0fb?s=96&d=mm&r=g","contentUrl":"http:\/\/2.gravatar.com\/avatar\/80b7a6910f5568a1312a460c8402b0fb?s=96&d=mm&r=g","caption":"mackyclyde"},"url":"https:\/\/www.mapprotocol.io\/blog\/author\/mackyclyde\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mapprotocol.io\/blog\/wp-json\/wp\/v2\/posts\/227"}],"collection":[{"href":"https:\/\/www.mapprotocol.io\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mapprotocol.io\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mapprotocol.io\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mapprotocol.io\/blog\/wp-json\/wp\/v2\/comments?post=227"}],"version-history":[{"count":4,"href":"https:\/\/www.mapprotocol.io\/blog\/wp-json\/wp\/v2\/posts\/227\/revisions"}],"predecessor-version":[{"id":235,"href":"https:\/\/www.mapprotocol.io\/blog\/wp-json\/wp\/v2\/posts\/227\/revisions\/235"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.mapprotocol.io\/blog\/wp-json\/wp\/v2\/media\/228"}],"wp:attachment":[{"href":"https:\/\/www.mapprotocol.io\/blog\/wp-json\/wp\/v2\/media?parent=227"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mapprotocol.io\/blog\/wp-json\/wp\/v2\/categories?post=227"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mapprotocol.io\/blog\/wp-json\/wp\/v2\/tags?post=227"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}