Nomad Bridge Hack Suspect Extradited to the US

Alexander Gurevich, 49, an Israeli national charged over the August 2022 Nomad bridge hack, has been extradited from Israel and made his initial appearance in federal court in the Northern District of California on 30 October, the US Justice Department said. He faces a 2023 indictment for damage to a protected computer, interstate transportation of stolen money and money laundering. Israeli court records give his name as Alexander Block, also spelled Blok.

He was arrested in Israel in May 2025 and “was recently extradited”, according to the DOJ release, which credits Israeli authorities with “substantial assistance”. Prosecutors allege he took virtual currency worth about $2.89m and exposed a flaw that others used to drain far more. An indictment is an allegation, and he is presumed innocent until proven guilty. His transfer ends a legal fight in which Israel’s Supreme Court rejected his argument that exploiting a smart-contract bug was not a crime.

In brief

Alexander Gurevich, 49, appeared in federal court in the Northern District of California on 30 October after extradition from Israel, the DOJ says.
He is charged over the Nomad bridge hack with damage to a protected computer, interstate transportation of stolen money and money laundering, and is presumed innocent.
Prosecutors allege he took 103 WBTC and 300 WETH, worth about $2.89m, on or about 1 August 2022.

What the US alleges in the Nomad bridge hack

Nomad was a cross-chain bridge, run by Illusory Systems, that let users lock crypto on one blockchain and receive matching tokens on another. According to the US extradition request, as summarised in the Israeli Supreme Court’s judgment, a software update in June 2022 left an unintended flaw in Nomad’s smart contracts. It let users receive tokens on one chain without locking anything of equal value on the other.

The DOJ says that on or about 1 August 2022 Gurevich executed four exploit transactions, moving 103 Wrapped Bitcoin (WBTC) and 300 Wrapped Ether (WETH) from Nomad’s address to one he controlled, worth approximately $2,894,390 at the time. He then converted the funds into other crypto, including Bitcoin, and moved them through several addresses “in order to conceal and disguise” their source, the department alleges. The judgment adds that the request describes him acting as “Bitliq.eth”, running six test transfers first, and that his activity revealed the flaw to others, who emptied a Nomad wallet holding more than $186m of other users’ assets.

Days later, according to the judgment, he returned some tokens and contacted a senior Nomad figure on Telegram, offering to give back the rest in return for payment for having brought the flaw to Nomad’s attention. The talks broke down, and Nomad went to US law enforcement. The extradition request lists four counts of damaging protected computers, one of interstate transportation of stolen money and three of money laundering. The DOJ says the first two charges carry up to 10 years in prison each and money laundering up to 20 years.

Israel’s courts rejected the “fair game” defence

He was arrested at Ben Gurion Airport in May 2025 while heading to Russia, Ctech reported, and the state asked the Jerusalem District Court on 2 May 2025 to declare him extraditable. After the district court agreed, he appealed. His side argued that using a smart contract as it was coded was lawful, and that blockchain transfers are public, so he could not have laundered anything.

A unanimous three-judge panel dismissed the appeal on 8 March 2026. Justice Ofer Grosskopf relied on an earlier ruling that “a house without a lock is not ownerless – and so too a computer”, and rejected the idea that the autonomous nature of smart contracts makes it acceptable to knowingly exploit their coding errors (TSN translation). President Yitzhak Amit then refused a further hearing on 26 August, noting the judgment had stretched one computer-crime offence further than before, but “without setting firm rules”.

The court’s money-laundering reasoning matters beyond Nomad

For compliance teams, the most useful part of the Nomad bridge hack case is the laundering analysis. His argument that public ledgers cannot be used to launder money was, in Justice Grosskopf’s word, “surprising”. The judgment noted that financial regulators in Israel and elsewhere see these platforms as raising laundering risk. Wallet details are visible, but the identities behind them are hidden.

The conduct described in the FBI affidavit is a familiar typology. Converting stolen tokens into other assets, partly converting them back and splitting them across accounts, with no economic purpose, is classic layering. The court said it did not matter that he was said to have used only some laundering methods. Showing actions meant to “hide or disguise” the source was enough at the extradition stage.

The bounty angle is the other lesson. Exploiters often frame a drain as white-hat work and then negotiate a reward. Bridge incidents keep coming, from the zkLink Nova bridge drain to the Zilliqa X-Bridge incidents. The Israeli ruling suggests that an after-the-fact offer to return funds for payment does not turn an exploit into authorised access. For exchanges and other off-ramps, flows tied to an exploit should be treated as suspicious whether or not a bounty is being discussed.

Bridges remain a soft spot. Hacken counted $1.18bn lost in Q3 2026, and the Binance hack showed the scale of what can go wrong. US prosecutors have been pressing cross-border crypto cases too, as with the Madagascar NFT scam charges.

Gurevich is presumed innocent, and the DOJ release sets out no trial date. The 2023 indictment will now be tested in a US federal court in the Northern District of California, not in an Israeli extradition hearing.