TLDR
- Alexander Gurevich, a Russian-Israeli citizen, was arrested in Israel for his alleged role in the $190 million Nomad bridge hack from 2022.
- Gurevich is facing extradition to the US on charges of money laundering and computer crimes, with potential penalties of up to 20 years.
- He allegedly exploited a vulnerability in Nomad’s protocol, stealing $2.89 million, before dozens of copycats joined in the attack.
- Gurevich attempted to flee to Russia using a new identity (“Alexander Block”) but was arrested at Ben-Gurion Airport on May 1.
- He allegedly contacted Nomad’s CTO via Telegram after the hack, requesting a $500,000 bounty for identifying the vulnerability.
A Russian-Israeli citizen allegedly involved in the $190 million Nomad bridge hack from 2022 has been arrested in Israel and faces extradition to the United States. Alexander Gurevich was apprehended at Ben-Gurion Airport on May 1 while attempting to board a flight to Russia.
Gurevich is accused of being the first to exploit a vulnerability in the Nomad bridge protocol in August 2022, personally stealing approximately $2.89 million worth of cryptocurrency tokens. The initial breach triggered a wave of copycat attacks that ultimately resulted in the protocol losing a total of $190 million.
Israeli authorities detained Gurevich just days after he had legally changed his name to “Alexander Block” in Israel’s Population Registry and received a passport under that new identity. This apparent attempt to evade law enforcement came shortly after his return to Israel from an overseas trip on April 19.
US federal prosecutors filed an eight-count indictment against Gurevich in the Northern District of California in August 2023. The formal extradition request was submitted to Israeli authorities in December 2024.
The Hack and Aftermath
The Nomad bridge hack was unique in how it unfolded. After Gurevich allegedly identified and exploited the initial vulnerability, dozens of copycat hackers quickly followed suit.
Blockchain security expert Peter Kacherginsky commented on the arrest, noting that Gurevich “fits the profile of a crypto-native threat actor: skilled in smart contract exploitation but ultimately undone by poor opsec.”
The attacker behind the $186M Nomad Bridge hack has been identified as Alexander Gurevich, aka "Block".
He fits the profile of a crypto-native threat actor: skilled in smart contract exploitation but ultimately undone by poor opsec.https://t.co/7U6plnewRh
— Peter Kacherginsky (@_iphelix) May 4, 2025
According to analysis from Coinbase, 88 unique wallet addresses participated in the attack as copycats, collectively responsible for removing $88 million from the bridge. Some participants later turned out to be “whitehats” or ethical hackers who returned the funds they had withdrawn.
Communication with Nomad
Court documents reveal that Gurevich allegedly reached out to Nomad’s chief technology officer, James Prestwich, via Telegram following the hack. Using a fake identity, he reportedly admitted to “amateurishly” seeking a crypto protocol to exploit.
In these communications, Gurevich allegedly apologized for “the trouble he caused Prestwich and his team” and voluntarily transferred about $162,000 into a recovery wallet the company had set up.
Prestwich offered Gurevich 10% of the value of the stolen assets as a bounty, a common practice in the crypto industry where protocols sometimes negotiate with hackers to recover funds. Gurevich reportedly said he would consult his lawyer but never continued the conversation.
At some point during these negotiations, Gurevich allegedly demanded a $500,000 reward for identifying the vulnerability. This type of arrangement, where hackers return most funds in exchange for keeping a portion as a “bounty,” has precedent in the crypto world.
The money laundering and computer crime charges Gurevich faces in the US carry a maximum sentence of 20 years, which is much harsher than any penalties he would face in Israel.
Israeli officials believe Gurevich carried out the attack while in Israel, as he reportedly arrived in the country just days before the $190 million exploit occurred in August 2022.
The Nomad bridge hack was described by blockchain researcher Samczsun as “chaotic” because of how easy it was for copycats to join in. “You didn’t need to know about Solidity or Merkle Trees,” he explained at the time. “All you had to do was find a transaction that worked, find/replace the other person’s address with yours, and then re-broadcast it.”
Gurevich’s case highlights the growing international cooperation in pursuing cryptocurrency criminals, even as they attempt to use multiple jurisdictions and identities to evade capture.
Stay Ahead of the Market with Benzinga Pro!
Want to trade like a pro? Benzinga Pro gives you the edge you need in today's fast-paced markets. Get real-time news, exclusive insights, and powerful tools trusted by professional traders:
- Breaking market-moving stories before they hit mainstream media
- Live audio squawk for hands-free market updates
- Advanced stock scanner to spot promising trades
- Expert trade ideas and on-demand support
