Israel extradites alleged Nomad bridge exploiter to US over $2.8M theft

What happened

Israel has extradited Alexander Block, an Israeli-Russian citizen who previously went by Alexander Gurevich, to the United States to face charges connected to the 2022 Nomad bridge exploit, the country's State Attorney's Office said. The handover took place early Thursday after his appeals against removal failed, according to The Jerusalem Post, whose reporting was cited by Decrypt and Unchained.

Block is accused of taking tokens worth more than $2.8 million by exploiting a flaw in Nomad's smart contracts in August 2022, allegedly operating under the username "Bitlik." A federal grand jury in the Northern District of California indicted him on Aug. 16, 2023, on eight counts: four of computer fraud, three of money laundering and one of transporting stolen property, according to the Supreme Court judgment in the case.

He was arrested at Ben Gurion Airport in May 2025 as he prepared to fly to Russia, shortly after changing his surname and obtaining a passport in his new name. US authorities requested his extradition on Dec. 10, 2024. The Jerusalem District Court found him extraditable in July 2025, and a Supreme Court panel upheld that ruling on March 8, 2026. Supreme Court President Isaac Amit then declined a request for a further hearing, the State Attorney's Office said. Block has not been convicted, and no date for a US court appearance had been made public as of Friday.

Why it matters

The case turned on an argument often aired in crypto: that someone who uses a smart contract exactly as its code allows has not committed a crime. Block's lawyers said he never altered Nomad's code and merely called functions the system offered. The Supreme Court disagreed. Justice Ofer Grosskopf, writing for the panel, reasoned that exploiting a flaw in a smart contract is no different from exploiting a bug in any other program, comparing it to a manufacturing defect that lets an ATM dispense cash for a sheet of paper, which does not make taking the money lawful.

The court also rejected the claim that public blockchain records defeat money laundering allegations, noting that ledgers reveal wallets but not who controls them. For decentralized finance protocols, the outcome signals that a permissive bug does not by itself create a legal right to withdraw funds, at least as Israeli law was read in this case.

What the data shows

The alleged theft totaled more than $2.8 million in tokens, preceded by six test transfers and followed by four main withdrawals. The wider drain of the Nomad wallet exceeded $186 million in user funds, of which about $22 million was recovered shortly afterward. The indictment carries eight counts, and the US extradition request was dated Dec. 10, 2024. Israel's district court approved removal in July 2025, with the Supreme Court affirming on March 8, 2026.

Background

Nomad's contracts were designed to confirm, through a function called proveAndProcess(), that a user had locked assets on one chain before tokens were issued on another. According to the US extradition request as summarized in the judgment, a June 2022 software update let withdrawals be routed through a different function, process(), which skipped that check. Block allegedly ran six test transfers, depositing funds back as he did so to avoid notice, before making four withdrawals worth more than $2.8 million around Aug. 1, 2022. He then allegedly spread the tokens across several wallets and swapped them into other cryptocurrencies.

Those withdrawals showed other users how the trick worked, and a Nomad-controlled wallet holding more than $186 million in user deposits was drained. Paradigm researcher Sam Sun described the ensuing rush as a "frenzied free-for-all," Decrypt reported at the time. Days later, Block allegedly returned some tokens and offered on Telegram to send the rest in exchange for payment for flagging the bug; negotiations began, but he went silent and Nomad contacted US law enforcement. Nomad recovered about $22 million in the days after the hack. In December 2025, the Federal Trade Commission proposed a settlement with Nomad operator Illusory Systems over the loss, which would require recovered funds to be returned to users who have not been reimbursed.

What to watch

The next steps sit with US prosecutors in the Northern District of California, where Block's first appearance and any trial schedule have yet to be announced publicly. Also unresolved is the FTC's proposed settlement with Illusory Systems, which would govern how recovered Nomad funds are returned to users, and whether other wallets that copied the exploit face enforcement. The Supreme Court's reasoning on code flaws could be cited in future cases involving DeFi protocols.

Questions readers ask