Russian-Israeli Citizen Arrested for $190M Nomad Bridge Hack

Alexander Gurevich, a Russian-Israeli citizen, is set to be extradited to the US following his arrest at an Israeli airport while attempting to board a flight to Russia. Gurevich is suspected of involvement in the $190 million Nomad bridge hack, which occurred in 2022. He is accused of exploiting a vulnerability in the Nomad bridge, resulting in the theft of approximately $2.89 million worth of tokens.

Gurevich's arrest came after a series of events that began with his return to Israel from an overseas trip on April 19. He was subsequently ordered to appear before the Jerusalem District Court for an extradition hearing. On April 29, Gurevich changed his name in Israel’s Population Registry to “Alexander Block” and received a passport under that name at Israel’s Ben-Gurion Airport the next day. He was arrested at the same airport two days later, on May 1, while waiting to board a flight to Russia.

Prosecutors allege that Gurevich reached out to Nomad’s chief technology officer, James Prestwich, on Telegram using a fake identity shortly after the hack. He admitted to exploiting a crypto protocol and apologized for the trouble he caused. Gurevich voluntarily transferred about $162,000 into a recovery wallet set up by Nomad. Prestwich offered Gurevich 10% of the value of the assets he had stolen, but Gurevich responded that he would consult his lawyer and never heard back from him after that.

During the negotiations, Gurevich demanded a reward of $500,000 for identifying the vulnerability. US federal authorities filed an eight-count indictment against Gurevich in the Northern District of California on Aug. 16, 2023, and obtained a warrant for his arrest. The US submitted a formal extradition request in December 2024. The money laundering charges that Gurevich faces carry a maximum of 20 years, significantly harsher than what he would face in Israel.

Gurevich is believed to have arrived in Israel a few days before the $190 million exploit occurred, prompting Israeli officials to believe he carried out the attack while in Israel. The hack involved dozens of copycat hackers who discovered and capitalized on the security vulnerability, leading to a total loss of $190 million.