Israel Extradites Alexander Block to US Over $2.8M Nomad Theft

Arrest at Ben Gurion Airport

Israel has extradited the alleged initiator of the 2022 Nomad bridge protocol theft to the United States, its State Attorney's Office confirmed on Thursday. Alexander Block, formerly known as Alexander Gurevich, was transferred to US custody early Thursday after appeals in Israel failed. He had been arrested at Ben Gurion Airport in May 2025 while waiting to board a flight to Russia, shortly after changing his surname and obtaining a passport under his new name. A federal grand jury in the Northern District of California indicted Block in August 2023 on four counts of computer fraud, one count of transporting stolen property and three counts of money laundering, and Washington filed its extradition request in December 2024. Prosecutors allege that a June 2022 software update left a flaw in Nomad's smart contracts, letting users receive tokens on one blockchain without locking the equivalent assets on another. Nomad runs a cross-chain bridge, a service that moves tokens between blockchains. Operating under the username “Bitlik,” Block is accused of running six test transfers before four main transfers around August 1, 2022, collecting tokens worth more than $2.8 million. The funds then moved through several wallets and were converted into other cryptocurrencies to conceal their origin, the extradition request states. His activity exposed the flaw to other users, who drained a Nomad-controlled wallet holding more than $186 million in customer funds. Days later, Block returned some tokens and contacted a senior Nomad official on Telegram, offering to hand back the rest in exchange for payment for finding the vulnerability. He then cut off contact, and the company turned to US law enforcement.

A Precedent on Code Exploits

The Jerusalem District Court approved the extradition in July 2025. On appeal, Block argued that his transactions relied on functions Nomad's automated system offered to any user, and that the public record of on-chain transfers undermined the money laundering allegations. Israel's Supreme Court rejected both arguments. As recorded in its judgment, the court held that exploiting a programming flaw can constitute unlawful computer intrusion even where the software technically permitted the action, and that publicly visible transactions do not identify the people behind wallets or rule out attempts to disguise where the funds came from. The ruling followed a review of the US extradition request, which set out the transfer pattern and the charges in full. Supreme Court President Isaac Amit later denied Block's request for a further hearing, which ends the Israeli phase of the case. The August 2022 exploit stripped the bridge of nearly all its funds, and because the original attack demanded little technical skill, other users copied the same flawed call, in effect a replay attack on the contract logic, a wave Paradigm researcher Sam Sun described at the time as “a frenzied free-for-all.” Nomad recovered about $22 million in the days after the incident. In December 2025, the Federal Trade Commission proposed a settlement with Illusory Systems, the bridge's operator, concluding that the loss followed a poorly tested software update. The proposed deal would require the company to return recovered funds to users who have not yet been reimbursed.

The Supreme Court's holding reaches beyond one defendant. Bridge exploits have repeatedly turned on the defense that the contract itself allowed the transfer, and the Israeli court has now closed that door for extradition purposes: software that permits a transaction does not immunize the person who triggers it from intrusion charges. The case also shows where prosecutors draw the line between a bug bounty and extortion, since Block's offer to return the funds for payment did not improve his position in either court. The $186 million loss came from copycat users rather than from Block himself, a distinction the US indictment preserves by charging him with the smaller $2.8 million sum. Any sentencing outcome would also turn on how much of the $2.8 million was ultimately returned, a figure the public record has not detailed. With the FTC settlement still requiring reimbursement for users left unpaid, bridge operators face criminal exposure on one side and consumer-protection scrutiny on the other, and the eight US counts now move toward trial in California.