Nomad

10 November 2021

Illusory Systems, Inc. incorporated in Delaware by Pranay Mohan, James Prestwich, and Austin Liau.

May 2022

Quantstamp begins security audit of Nomad's smart contract system.

9 June 2022

Quantstamp delivers final audit report identifying 40 issues, including input validation edge cases. Audit team notes the Nomad team misunderstood at least one flagged issue.

21 June 2022

Nomad deploys a routine upgrade to its Replica smart contract that initializes the trusted Merkle root to 0x00, introducing the critical vulnerability. The deployed code differs from the audited version.

August 2022

An initial attacker discovers the zero-root initialization bug and begins draining funds from the Nomad bridge by calling the process() function with a zero root and modified recipient addresses.

2 August 2022

Over 300 wallet addresses join the exploit after the initial attacker's transaction calldata becomes visible on-chain. Approximately $190 million in user funds are drained in a chaotic free-for-all. CNN Business, TechCrunch, and CoinDesk report the event contemporaneously.

5 August 2022

Nomad announces a 10 percent bounty program, offering legal immunity and fund retention for any attacker returning at least 90 percent of drained assets.

11 August 2022

Coinbase publishes incident analysis estimating 88 percent of participating addresses were copycats; copycats collectively stole approximately $88 million.

20 August 2022

Over $36 million returned to Nomad's recovery address by more than 40 participating wallets — approximately 19 percent of total stolen funds.

December 2022

Nomad relaunches bridge to allow users to withdraw remaining bridged assets. The relaunch attracts negligible user activity and TVL.

2023

Class action lawsuit Singh v. Illusory Systems, Inc. et al. (1:23-cv-00183, D. Del.) filed by affected users asserting RICO and negligence claims.

16 August 2023

Federal grand jury in the Northern District of California issues an eight-count indictment against Alexander Gurevich for his alleged role in the exploit, including wire fraud, conspiracy, and money laundering.

8 April 2024

Federal district court dismisses RICO claims and most negligence claims in Singh v. Illusory Systems; fraud claim allowed to proceed.

December 2024

United States formally requests extradition of Alexander Gurevich from Israel.

19 April 2025

Gurevich re-enters Israel during the Passover holiday. Israeli authorities order him to appear for an extradition hearing, which he ignores.

30 April 2025

Gurevich legally changes his name to 'Alexander Block' in the Israeli Population Registry in an alleged attempt to conceal his identity.

May 2025

Israeli police arrest Alexander Gurevich at Ben-Gurion Airport while he is attempting to board a flight to Russia. Israeli authorities approve extradition to the United States.

17 December 2025

FTC announces proposed consent order requiring Illusory Systems to repay approximately $37.5 million to affected users and implement a 10-year information security program. Federal Register notice published December 19, 2025.