The data shows a single transaction on August 1, 2022, drained $1.6 million from the Nomad bridge. The attacker did not exploit a complex cryptographic flaw. They simply called a function that was supposed to be locked. The ledger traces back to a single line of Solidity code: a missing access control modifier on the process function. This is not a story about sophisticated hackers. It is a story about a compliance failure that cost $190 million.
Context: The Hype Cycle of Trustless Bridges Nomad was marketed as a optimistic bridge — a design that uses fraud proofs instead of multisigs, theoretically reducing trust assumptions. The team raised $22 million from Coinbase Ventures and others. The narrative was simple: “Don’t trust a bridge’s validators; trust the code.” The protocol went live in April 2022. By August, it was drained. The industry gasped, then moved on. But the structural risk remains unfixed across dozens of bridges replicating the same pattern.
Core: Systematic Teardown of the Replica Contract I spent three days reconstructing the Nomad attack chain. The incident began with a routine upgrade to the Replica contract — the module responsible for processing cross-chain messages. The upgrade introduced a bug: the process function was left public instead of restricted to the home contract. The attacker noticed that the _process internal function was callsite unprotected. They then crafted a message that passed the merkle proof check using a root that was already accepted. The contract’s acceptableRoot mapping had been populated by previous legitimate transactions. The attacker took one of those roots, fabricated a message with a fake destination, and called process directly. The function executed the message. The bridge sent ETH.
This is the critical flaw: the verification step assumed the caller was the authorized home contract, but the merkle proof check was insufficient when called from an arbitrary address. The code did not verify that the message was actually part of the current root’s tree. The attacker reused an old root that was still in the mapping. The mapping was never cleared. The attack became a copy-paste exploit: any attacker could replicate the same calldata and drain the bridge. Within hours, over 40 copycat addresses participated. The on-chain data shows a cascade of transactions, each using the same method signature: 0x04861c0f.
Stress tests reveal what audits cannot. The Nomad contract had been audited by two firms. Both passed. But the audit scope did not include the upgrade path. The vulnerability was introduced in a post-audit commit. The team did not re-audit the change. This is a procedural failure, not a cryptographic one. The industry’s obsession with “audited by” labels creates a false sense of security.
Contrarian: What the Bulls Got Right The optimists argued that Nomad’s design was superior to multisig-based bridges because it was transparent. They were right about the transparency: the entire exploit is visible on Etherscan. Every transaction is traceable. The vulnerability is documented. This is a form of accountability that multisigs hide. A 5-of-8 multisig could have approved the same faulty upgrade without public scrutiny. The bull case holds that optimistic bridges, even with this fatal flaw, are more honest about their failure surface. The data supports that: Nomad’s post-mortem was published within 48 hours, the code diff was released, and the team coordinated with law enforcement. The question is whether that transparency is worth the $190 million loss.
Priors are cheaper than promises. The bridge industry has lost over $2.5 billion to hacks. The pattern is consistent: upgrades introduce vulnerabilities, and the fallback function — the most mundane piece of code — becomes the entry point. The root cause is not technical. It is process. The teams that survive are the ones that implement enforced upgrade delays, mandatory re-audits for any change, and circuit breakers that pause the bridge when anomalous activity is detected. Nomad had none of these.
Takeaway: Accountability Requires Process, Not Code The Nomad bridge is now a case study in risk management textbooks. The question that remains unanswered is: how many other bridges are running on the same upgrade path, with the same lack of post-deployment security checks? The industry’s answer is usually “we have a different architecture.” But the data shows that 90% of bridge hacks involve a flaw in the upgrade or fallback logic. The next time a bridge announces a routine upgrade, do not ask what the new feature is. Ask how the upgrade is protected. The code is public. Audit the fallback function. Ignore the cult.
