What happened
A code change made on May 26, 2022, during an audit, and deployed on June 21, 2022, caused Nomad’s Replica contract to treat a zero value as a trusted root. Any message could be forged as long as it had not already been processed (project's own root-cause analysis, 2022-08-05).
Because the exploit was easy to copy, many addresses drained funds. Nomad offered a 10% bounty and treated anyone returning at least 90% as a white hat.
Scale, from official records
- No official total-loss figure found; about US$38.8 million in the recovery pool as of November 11, 2022 (Nomad’s own update, 2022-11-11)
The Canadian angle
Global reference case; no Canadian-specific angle sourced.
What broke
An upgrade and initialization bug that slipped in during an audit window and could be replayed by anyone.
What a user could have checked
- Whether the exact deployed code was audited, including recent upgrades.
- Whether the bridge has rate limits or pause controls.
Recovery
About US$38.8 million recovered as of 2022-11-11 (project's own figure).
Sources
- Nomad bridge hack: root cause analysis — Nomad (archived), 2022-08-05
Supports: Root cause, change dates (project account) · checked 2026-11-01 - Recovery wallet operations — Nomad (archived), 2022-11-11
Supports: About $38.8M recovered (project figure) · checked 2026-11-01