Nomad bridge case: Gurevich extradited over alleged theft

Contents

At a glance

DOJ announced Alexander Gurevich’s US court appearance over alleged Nomad bridge theft. The case concerns 2022 transactions; repayment remains unconfirmed.

US court appearance after extradition

Alexander Gurevich appeared in a California federal court on 30 October after his extradition from Israel, according to the US Department of Justice. Prosecutors accuse him of taking about $2.89 million in cryptocurrency from the Nomad bridge. The announcement concerns a new court appearance over an older exploit, with the alleged transfers dating to August 2022.

DOJ says Israeli authorities arrested Gurevich in May 2025. Under the indictment, prosecutors allege four unauthorized transactions moved 103 WBTC and 300 WETH to an address he controlled. Those tokens represent wrapped Bitcoin and wrapped Ether. The dollar estimate refers to their value when the transactions occurred.

[1]

The older bridge vulnerability

Coinbase researchers Peter Kacherginsky and Heidi Wilder described the wider Nomad incident in an analysis published on 9 August 2022. A bridge transfers assets or messages between blockchains; its software must verify that a transfer request is genuine before releasing assets.

Their report explains how a zero-valued trusted root interacted with message verification, allowing the contract to accept fraudulent messages. They also observed hundreds of copycat addresses exploiting the contract. That historical analysis explains the protocol failure. It does not identify Gurevich or establish which addresses belong to him; the current criminal allegations come from DOJ.

[2]

Charges and unresolved recovery questions

Prosecutors charge Gurevich with computer damage, transporting stolen money across state lines and money laundering. They allege he converted assets and moved funds between addresses to conceal their origin. He remains presumed innocent. The court appearance does not establish a conviction or sentence.

The announcement does not confirm a completed repayment to Nomad users or a current recovery total. Readers should keep the amount attributed to this defendant separate from losses across the wider incident. Neither extradition nor a criminal charge establishes that authorities have recovered the disputed tokens.

[3]

Reading the case as a bridge user

For someone following a bridge loss, the useful next records are a court ruling, a verified asset-recovery notice and any documented distribution to affected users. Each answers a different question: responsibility, control of assets, or payment. A report of transfers between wallets alone cannot establish all three.

The technical context also matters when reviewing wallet security. Managing token permissions addresses a different exposure from faulty bridge message validation. Our related permissions guide explains the former; revoking an approval cannot repair a vulnerable bridge contract or undo an already executed transfer.

[3]

Evidence & sources

Source record: Oct 30, 2026 · Checked: Nov 1, 2026

Record limits · Checked on 1 November 2026. DOJ announced the court appearance on 30 October. The alleged transactions occurred in 2022; charges remain allegations.

[1]Source reported
DOJ announced Gurevich’s US court appearance after extradition and alleged transfers of 103 WBTC and 300 WETH.
Supporting excerpt: Israeli national extradited to face charges over virtual currency theft
Original quotation
Gurevich was arrested in May 2025 in Israel and was recently extradited to the United States.
Israeli national extradited to face charges over virtual currency theft ↗
Source language: EN · Captured Nov 1, 2026
[2]Source reported
Coinbase’s historical research describes fraudulent message authorization and copycat exploitation in the Nomad incident.
Supporting excerpt: Nomad Bridge incident analysis
Original quotation
hundreds of copycats joined a massive exploitation of a single contract.
Nomad Bridge incident analysis ↗
Source language: EN · Captured Nov 1, 2026
Supporting excerpt: Nomad Bridge incident analysis
Original quotation
acceptableRoot() returning True and authorizing fraudulent messages.
Nomad Bridge incident analysis ↗
Source language: EN · Captured Nov 1, 2026
[3]Source reported
DOJ lists criminal charges and preserves the presumption of innocence; its notice does not confirm completed repayments.
Supporting excerpt: Israeli national extradited to face charges over virtual currency theft
Original quotation
An indictment is merely an allegation.
Israeli national extradited to face charges over virtual currency theft ↗
Source language: EN · Captured Nov 1, 2026