Signal Snapshot
- A 2022 bridge theft is now a US court case.
- Israel sent Alexander Block to US officials early Thursday. He had fought extradition in Israeli courts.
- He faces claims he took about $2.8 million from Nomad. Prosecutors say his exploit exposed a wider flaw.
- Other users then drained more than $186 million from a Nomad wallet. That second drain is the larger loss.
- Israel’s Supreme Court rejected his appeal. It ruled that using a code flaw can still be hacking. Top risk now is what US courts decide next.
Key Takeaways
- Israel extradited Alexander Block to the US over an alleged $2.8 million theft from Nomad in 2022.
- Prosecutors say his transfers exposed a flaw that others used to drain more than $186 million.
- The real investor read is simple. Code permission is not legal permission, and bridge risk is legal risk too.
What Happened
Israel’s State Attorney’s Office said it transferred Alexander Block to US custody early Thursday. The news was reported through the alleged Nomad bridge theft case file. Block was formerly known as Alexander Gurevich.
He was arrested at Ben Gurion Airport in May 2025. Police said he was preparing to fly to Russia. He had changed his surname shortly before. He had also obtained a passport in his new name.
A federal grand jury in the Northern District of California indicted him in August 2023. The indictment lists four counts of computer fraud. It also lists one count of transporting stolen property. It adds three counts of money laundering.
The US asked Israel for extradition in December 2024. The Jerusalem District Court approved extradition in July 2025. Israel’s Supreme Court then rejected his appeal. That cleared the path for transfer.
The case centers on a June 2022 software update. That update left a flaw in Nomad smart contracts. The flaw let users receive tokens on one chain without locking the same value on another chain. In plain terms, people could take out more than they put in.
Prosecutors say Block used the name Bitlik on chain. They say he made six small test transfers first. He then made four main transfers around August 1, 2022. Those transfers brought him tokens worth more than $2.8 million.
They say he then moved the tokens through several wallets. He converted them into other coins to hide their origin. His activity was public on chain. But prosecutors say public does not mean legal.
His transfers also exposed the flaw to others. Other Nomad users then drained a Nomad wallet holding more than $186 million in user funds. A few days later, Block returned some tokens. He then messaged a senior Nomad official on Telegram. He offered to return the rest for a fee for finding the flaw. He later cut off contact. Nomad then went to US law enforcement.
On appeal, he argued the system allowed the moves. He said the transfers used normal functions. He also argued the public chain record hurt the laundering claim. The court rejected that view. It said exploiting a programming flaw can be unlawful intrusion even where the software allowed it. More detail is laid out in the Israeli Supreme Court judgment summary cited in the report.
Why It Matters
Bridges are simple to describe. They lock coins on one chain. They release matching coins on another chain. If that lock breaks, money can leave with no backing. That is what prosecutors allege here.
The first loss was about $2.8 million. The second loss was more than $186 million. The gap matters for investors. One small exploit can teach a crowd. Once the method is public, anyone can copy it. Funds can leave in minutes.
This is also a legal signal. The defense was code allowed it. The court said no. Permission in software is not permission in law. That line matters for future exploit cases. It may shape how white hats and black hats act after they find a bug.
His Telegram offer also matters. He returned some funds. He asked for payment to return the rest. Prosecutors will likely frame that as leverage. Defense lawyers often frame such talks as good faith rescue. US courts will now test which story fits.
For crypto rails, this touches settlement and custody. Bridges settle value across chains. They also hold user funds while they do it. When settlement logic fails, custody fails too. Users do not hold IOUs. They hold losses.
The second order point is trust. Bridges need speed and size to work. But speed helps copycats too. A public mempool is a public classroom. Every exploit is a live demo. That is why bridge design now favors limits, pauses, and caps.
Token Metrics View
Token Metrics flagged this item as one of its main items in Daily Pulse coverage. That means editors saw it as a lead story for the day. It is not a routine filing update.
The supplied prediction market data does not track this court case. It tracks US midterm control. One market asks if Democrats control the House after the 2026 midterms. It is priced near 94%. Two related markets ask about Republican control. They are priced near 7% each.
Those numbers say nothing about Block or Nomad. They reflect a different risk entirely. They do not change the read on bridge safety. We mention them only to be clear on what the feed contained.
No smart money flow data was supplied for a related token. No spot price or trend read was supplied either. So there is no on chain money signal to add here. The legal record is the signal.
What matters for holders is process risk. Court cases move slowly. Crypto prices move fast. Legal headlines can still dent trust in bridges. They can also push builders toward safer designs.
Market Context
This is a security event. It is not a market structure shift. It is not a regulatory shift. It is a theft case with a protocol flaw at its core.
The flaw came from a June 2022 update. Updates are normal. But bridge updates are high stakes. A small error in message proof can open the vault. Here the error allegedly let users skip the lock step.
The pattern is worth naming. First comes a quiet test. Six small transfers probed the system. Then comes the larger take. Four main transfers followed. Then comes the crowd. Others copied the method at scale.
That crowd phase caused most of the harm. The first taker got about $2.8 million. The crowd took more than $186 million. Investors should note the ratio. The finder is rarely the biggest drain. The public method is.
No historical analogs were supplied with this story. So we do not compare it to other named hacks. The lesson stands on its own facts. Public exploits scale fast. Private fixes must scale faster.
Extradition adds another layer. The US requested him in December 2024. Israel arrested him in May 2025. Courts ruled through July 2025 and appeal after that. Transfer happened early Thursday. That is a long chain. Cross border crypto cases take time. They still move.
The name change also stands out. He changed his surname from Gurevich to Block. He got a new passport. He was stopped while trying to fly to Russia. Prosecutors will likely cite that as flight risk. Courts often view such steps that way.
Risks to Watch
The main risk is scope creep. If US filings add new wallets, the loss figure could grow. If filings add new counts, the case could widen. Watch docket updates for superseding charges.
A second risk is proof. Prosecutors must tie Bitlik to Block. They must tie wallets to him. They must show intent to steal, not just test. On chain trails help. But identity proof still matters in court.
A third risk is the laundering theory. The defense says public transfers hurt that claim. Prosecutors say hops and swaps show hiding. The judge will decide what counts as concealment on a public ledger.
A fourth risk is bridge contagion. Headlines can scare users away from all bridges. Liquidity can thin out. Thin liquidity can raise costs for honest users. Fear can outlast facts.
What would make this matter less. An acquittal on key counts would blunt the signal. Proof that the $186 million drain was unrelated would shrink the story. A quick plea with full return of funds would also cool it. So far none of those have happened.
What to Watch Next
- Watch for a US initial court date and plea. A not guilty plea means a long fight. A guilty plea means fast sentencing talk.
- Watch for bail and detention rulings. Flight risk claims often decide custody. Airport arrest and name change will come up.
- Watch for asset recovery news. Any return of tokens would cut losses. Any sale or swap would raise new tracing work.
- Watch for Nomad user recovery updates. Who got paid back and how much matters. Silence on payouts keeps risk high.
- Watch for the written US indictment details. Wallet maps and chat logs will shape the case. Facts will beat rumors.
This is information only. It is not legal advice. It is not investment advice. Do your own work and check primary filings.
Sources / Data Used
- Decrypt report on extradition
- Token Metrics data used: Daily Pulse classification as main items, plus supplied Polymarket midterm markets for context
