Israel Extradites Alleged Nomad Bridge Exploiter to US Over $2.8M Theft: Report

What it is

Israel extradited Alexander Block (formerly Alexander Gurevich), an Israeli-Russian citizen, to the US to face charges over about $2.8 million taken from the Nomad bridge around 1 August 2022. The report relies on Israel's State Attorney's Office, The Jerusalem Post and Israel's Supreme Court judgment. The page does not give the extradition date beyond "Thursday".

How it works

The US extradition request, as quoted in the judgment, says a June 2022 update left a flaw in Nomad's smart contracts. Users could receive tokens on one blockchain without locking the equivalent assets on another.

Block, using the username "Bitlik", allegedly made six test transfers and then four main transfers, receiving tokens worth more than $2.8 million. They then allegedly moved the tokens through several wallets and converted them into other cryptocurrencies to hide their origin.

The request alleges this exposed the flaw to other users, who drained a Nomad-controlled wallet holding more than $186 million. Paradigm researcher Sam Sun called the copycat phase "a frenzied free-for-all", because the attack took little technical knowledge to copy.

Legal record

• A federal grand jury in the Northern District of California indicted Block in August 2023: four counts of computer fraud, one of transporting stolen property and three of money laundering.
• The US requested extradition in December 2024. Block was arrested at Ben Gurion Airport in May 2025, preparing to fly to Russia, after changing surname and getting a passport in the new name.
• The Jerusalem District Court approved extradition in July 2025. Block appealed, arguing the transactions used functions available in Nomad's automated system and that public blockchain records undermined the laundering allegations.
• The Supreme Court rejected both arguments. It held that exploiting a programming flaw can be unlawful computer intrusion even when the software technically allowed the action. It also held that visible transactions do not necessarily identify who controls wallets or rule out concealment of fund origin. Supreme Court President Isaac Amit later denied a further hearing.

What to do

The page gives no technical remediation. For teams running bridges or bug bounty programs, it records two facts:

• The FTC proposed a settlement with Illusory Systems (Nomad's operator) in December 2025, saying the bridge lost $186 million after hackers exploited a poorly tested update. The settlement would require returning recovered funds to users not yet reimbursed. Nomad recovered about $22 million in the days after the hack.
• A few days after the theft, Block returned some tokens and contacted a senior Nomad official on Telegram, offering to return the rest in exchange for payment for finding the flaw. Block later cut off contact, and Nomad went to US law enforcement.

Caveats

The charges are allegations from the extradition request, and Block has not been tried. The page does not say how Block's plea or trial will proceed in the US.