TL;DR

So far in 2022, five cross-chain bridge attacks have led to losses of $1,317,000,000, amounting to 57% of the total losses in Web3 in 2022. The security vulnerabilities inherent in cross-chain bridges coupled with the lack of expertise to defend against attacks are primary drivers for the amount of assets lost. The Nomad Bridge exploit ranks as 3rd largest attack this year, behind the Ronin Bridge ($624m) and Wormhole Bridge ($326m) exploits.

Security Issues With Cross-Chain DeFi Bridges

Before we examine the Nomad Bridge exploit, it is worth exploring some of the inherit security issues that come with cross-chain bridges. Vitalik Buterin has written about why he is pessimistic on cross-chain applications on Reddit due to the implications of 51% attacks, however there are more issues to consider. In a clip posted on 22 July 2022, James Prestwich, the founder of Nomad explains how there’s a lack of expertise in building security models for cross-chain applications and how it could take another year to gain a standard expertise.

Individuals can’t simply move their assets from one blockchain to another; instead, they have to use a cross-chain bridge to achieve this. These protocols work by an individual investor depositing their tokens on one chain, and receiving a debt token on the other chain. Once an individual burns their debt token on one chain, the deposit is released on the other chain.

To achieve this, cross-chain bridges combine multiple structures such as custodian, debt issuer, and an oracle. This makes cross-chain bridges somewhat vulnerable as there are multiple attack avenues for would-be hackers to exploit.

Because of these multiple attack avenues, malicious actors have targeted cross-chain applications as a way to steal vast amounts of funds. Bridge exploits can have a severe implications on wrapped tokens due to loss of deposits rendering the debt token worthless in extreme cases.

So far in 2022, cross-chain exploits have been devastating with five exploits amounting to $1,317,000,000 in losses amounting to 57% of all losses this year. We’ll break down these exploits below, and see how unique the Nomad Bridge attack is.

Ronin Bridge

The Ronin Bridge exploit is the largest DeFi exploit ever committed with evidence that the North Korean Lazarus Group was behind the attack. At the end of March, Ronin, an ETH sidechain built for the nonfungible token game named Axie Infinity, was hacked for over 173,600 Ether (ETH) and 25.5 million USD Coin (USDC) for over $600 million. The company officially reported that the hackers managed to get access to private keys to validator nodes resulting in the compromise of five validator nodes. Later reports showed how an advanced spear phishing attack was the main cause for this exploit. The Ronin chain consisted of nine validator nodes and the hackers managed to get access to four of them along with a third-party validator run by decentralized autonomous organization Axie DAO.

Wormhole Bridge Exploit

On 02 February 2022, the second largest cross-chain bridge exploit occurred on the Wormhole Bridge. In this incident, the attacker was able to bypass the verification process of the protocol leading to 120,000 Wormhole Ethereum (WeETH) lost. During the attack, the hacker bypassed the verification step by injecting a fake sysvar account and successfully generated a malicious “message” that specified for 120,000 wETH to be minted. By invoking the “complete_wrapped” function with the malicious “message”, the attacker successfully minted 120,000 wETH. Two minutes after the minting, the exploiter bridged 10,000 ETH to the Ethereum blockchain and another 80,000 ETH transaction occurred on the Ethereum blockchain about 20 minutes later. To this day, the funds are still sitting in the attacker’s wallets.

Harmony

On June 23, 2022 at 11:06:46 AM +UTC, the bridge between Harmony chain and Ethereum experienced multiple exploits. Our expert analysis identified twelve attack transactions and three attack addresses. Across these transactions the attacker netted various tokens on the bridge including ETH, USDC, WBTC, USDT, DAI, BUSD, AAG, FXS, SUSHI, AAVE, WETH, and FRAX. The transactions vary in value but range from $49,178 to upwards of $41,200,000. The attacker accomplished this by controlling the owner of the MultiSigWallet to call the confirmTransaction() directly to transfer large amounts of tokens from the bridge on Harmony, which led to a total loss around $97M worth of asset on the Harmony chain which was transferred into Tornado Cash.

Qubit

An earlier attack against Qubit is also an example of a cross-chain bridge exploit. Qubit was hacked for $80 million on January 27, 2022. In this exploit, the attacker called deposit() in the QBridge contract without any ETH attached in this transaction. The hacker abused the functions of the QBridge contract and faked an ETH event with an ERC20 event. Faking the ETH event enabled the malicious actor to pass the validation in the QBridgeHandler and mint around 77,162 qxETH in the crossed chain. The hacker then deposited the stolen funds into Tornado Cash.

Nomad Exploit

The Nomad Bridge was exploited for $190m due to the initialization process where the “committedRoot” is set as ZERO. Due to the vulnerability the attackers were able to bypass the message verification process and drained the tokens from the bridge contract with the Total Value Locked plummeting to ~$12k from $190m. This essentially made it possible for exploiters to deposit 1 ETH for example on one chain, and receive 100 ETH on the other. You can read our expert incident analysis here

What stands out this exploit from the rest is that it would appear that not one threat actor was participating in this attack. We have discovered that at least 41 wallets have participated in the exploit potentially making it the first Web3 “mob” attack. The ease in which exploiters were able to extract funds from the bridge likely contributed to the amount of wallets participating.

One of the first suspicious transaction came at 21:32 UTC with 100 wBTC ($2.2m) being transferred to 0x56d8… From there, a frenzy of outflowing tokens were observed.

We have also seen how this exploit has attracted previous Web3 hackers such as the Rari Capital exploiter.

Another interesting aspect of this attack is that there has been a phishing attempt by another malicious actor with the EOA holding ENS nomadexploiter.eth sending onchain messages to EOAs holding fundings from the exploit. The ENS was registered this morning at 05:53 AM UTC and is impersonating Nomad to negotiate with the hackers. Here is one example of the messages sent:

Nomad have confirmed on Twitter that they are not behind these messages:

Conclusion

The exploit on Nomad is a painful reminder just how devastating cross-chain bridge exploits can be. With 5 exploits on cross-chain protocols accounting for 57% of the total Web3 losses in 2022, the need to have secure cross-chain applications is of paramount importance for wider adoption. It is likely that more exploits of this nature will occur in 2022, however teams can sure up their security by careful testing as well as third part audits to mitigate against these highly damaging hacks.