Nomad’s $2.8M Bug Walk Gets an Israeli Exit, a U.S. Indictment and 4 Strictly No Rounds

Israel has extradited an Israeli-Russian citizen to the United States to face charges over the alleged theft of about $2.8 million from crypto bridge Nomad, Israel’s State Attorney’s Office announced on Thursday, according to The Jerusalem Post. The man, Alexander Block, formerly known as Alexander Gurevich, was transferred to U.S. authorities early Thursday after unsuccessful appeals in Israel.

Gurevich was arrested at Ben Gurion Airport in May 2025 while preparing to fly to Russia, shortly after changing his surname and obtaining a passport in his new name. He is accused of being the first person to exploit a vulnerability in Nomad’s smart contract, siphoning $2.89 million in tokens and triggering a digital stampede that contributed to a $190 million collapse.

A federal grand jury in the Northern District of California indicted Block in August 2023 on four counts of computer fraud, one count of transporting stolen property and three counts of money laundering, according to Israel’s Supreme Court judgment. The U.S. requested his extradition in December 2024, and the Jerusalem District Court approved the transfer in July 2025.

According to the U.S. extradition request, a June 2022 software update left a flaw that allowed users to receive tokens on one blockchain without locking up the equivalent assets on another. Block, operating under the username “Bitlik,” allegedly conducted six test transfers before making four main transfers around August 1, 2022, receiving tokens worth more than $2.8 million. He then allegedly moved the tokens through several wallets and converted them into other cryptocurrencies to conceal their origin.

Block’s actions exposed the vulnerability to other Nomad users, who drained a Nomad-controlled wallet holding more than $186 million in user funds, the request alleges. A few days later, he returned some tokens and contacted a senior Nomad official on Telegram, offering to return the rest in exchange for payment for identifying the flaw. He later stopped communicating with Nomad, which referred the matter to U.S. law enforcement.

On appeal, Block argued that the transactions used functions available within Nomad’s automated system and that the public blockchain record undermined the money-laundering allegations. Israel’s Supreme Court rejected both arguments, holding that exploiting a programming flaw could constitute unlawful computer intrusion even when the software technically permitted the action. It also found that publicly visible transactions do not necessarily identify the people controlling wallets or rule out efforts to conceal their ownership.