Nomad Token Bridge Hack

**FTC Orders Nomad to Return Stolen Funds and Reform Security After $186M Crypto Hack** The Federal Trade Commission (FTC) has reached a settlement with **Illusory Systems (operating as Nomad)**, requiring the company to return recovered funds to victims and implement sweeping cybersecurity reforms. The order follows a **2022 breach** in which hackers exploited a vulnerability in Nomad’s **Token Bridge**—a smart contract solution designed to transfer cryptocurrency across blockchains—stealing **$186 million** from users. The FTC’s investigation found that Nomad **misrepresented its security practices**, advertising its platform as “high security” and “security first” while failing to implement basic safeguards. In **June 2022**, the company deployed **untested code** after a security audit, leaving a critical flaw unaddressed. By **July 2022**, attackers exploited the vulnerability, draining user funds. White hat hackers later secured **$37 million** of the stolen assets, which Nomad is now required to return. The FTC’s complaint highlighted **systemic security failures**, including: - **Inadequate testing**: Most pre-deployment checks focused on functionality, not security. - **Lack of safeguards**: No automated fraud monitoring, circuit breakers, or kill switches to halt suspicious transactions. - **Delayed response**: The breach was detected via **social media**, not internal systems, and engineers scrambled to respond—including relaying code fixes mid-flight. - **Ignored warnings**: Months before the hack, an engineer warned leadership about weak testing practices, citing a prior incident where untested code caused losses. Nomad also **overrode internal efforts to reimburse users** after a separate bug in its web interface led to losses, with executives reportedly stating the platform offered “no guarantees of safety.” Under the settlement, Nomad must **develop a comprehensive cybersecurity program**, address flaws identified by the FTC, and submit to **third-party assessments**. The case underscores the FTC’s stance that companies must **deliver on security promises**—or face enforcement action.