Israel extradites alleged Nomad bridge exploiter after ruling that a code flaw can be 'intrusion'

Israel has sent a man accused of exploiting the Nomad crypto bridge to the United States to face charges, according to reports. He is alleged to have taken about $2.8 million.

What happened

Before the extradition, Israel’s Supreme Court ruled on a key legal question: whether taking money through a coding flaw counts as a computer crime. The court found that exploiting such a flaw can count as computer intrusion, even when the software itself allowed the transaction to go through.

Background

Nomad was a bridge, a service that moves crypto between different blockchains. In 2022 a bug in its code meant that almost anyone could copy a successful withdrawal transaction, change the destination address and take funds. Hundreds of wallets joined in, and around $190 million was drained in a matter of hours.

Many of those involved later argued that they had simply used the system as it was written. In the world of smart contracts, a common defence has been that “code is law”: if the software permits a transaction, it is not theft.

Why it matters

The Israeli ruling pushes back hard against that argument. It treats intent and the purpose of a system as what matters, not only what the code technically allowed.

That is significant for future cases. Courts in other countries have not settled the question in the same way, and people who exploit bugs in decentralised finance have sometimes avoided charges. A clear ruling from a national supreme court gives prosecutors in other jurisdictions a reference point when they argue that exploiting a flaw is a crime.