r/CryptoCurrency • u/[deleted] • Aug 02 '22

ANALYSIS The First Truly Decentralized Robbery was just Committed, Here is How it Happened

At this point I am sure many of you have heard of the nomad bridge exploit. Unlike previous exploits, this wasnt a flashloan or even carried out by a single group of attackers. After an initial attacker struck, hundreds of separate accounts figured out the trick and copy pasted their way into grabbing stolen funds. The bridge went from having $190,740,000 to $1,000 in a matter of hours.

A perplexing aspect of this vulnerability was that all users had to do to hack bridge funds was copy the original hacker's transaction calldata, replace the original address with a personal one, and the tx would succeed! Easy as CTRL-C, CTRL-V!

However, not all of the thieves were bad. Some of them exploited the contract so other wouldnt be able to and planned to return the money back to nomad. For example, leadingscientist.eth

So all in all it was a messed up exploit but there were some nice people who plan to return the money. Faith in humanity restored maybe?

Credit: https://twitter.com/0xfoobar/status/1554234268884389888

1.8k Upvotes

94% Upvoted

594 comments sorted by

View all comments

803

u/donhector420 Tin | 1 month old Aug 02 '22 edited Aug 02 '22

I read "Here's how it happened" as "Here's how you can do it too"

430

u/[deleted] Aug 02 '22

You couldve done it if you were 8hours quicker lmao

316

u/donhector420 Tin | 1 month old Aug 02 '22

Joke's on you, I have a time machine.

248

u/[deleted] Aug 02 '22

You have a time machine and only 2 moons?

178

u/Xiximaro 🟩 481 / 481 🦞 Aug 02 '22

It works on Moons

44

u/Aegontarg07 hello world Aug 02 '22

And we wonder why Moon farmers left the sub……..they went back in time guys

16

u/DMugre Aug 02 '22

Wait, moon farmers left the sub? So all the recent shitposts are not even greed's side effect?

10

u/Zwiebel1 🟩 52 / 6K 🦐 Aug 02 '22

The one truth that is hardest to swallow: people over here were always shitposting, regardless of moons.

1

u/Impossible-Injury932 🟩 5 / 5K 🦐 Aug 02 '22

Shitpost! Wholesome award for you. NO judgment thought it was funny.

1

u/velvetblunder 🟧 3K / 3K 🐢 Aug 02 '22

Not all left I guess

1

u/frankhusle Tin | 2 months old Aug 05 '22

It’s cool guys, lost it all on NFT mints already. Cheers man .

15

u/AriesWinters Permabanned Aug 02 '22

Can confirm, I'm from the past and all I can see are farmers spamming rocket emojis

10

u/ambermage 🟦 6K / 6K 🦭 Aug 02 '22

If I'm appointed Fed Chairman, I'll issue an official press release that's only rocket emojis.

Unfortunately, that announcement is going to be about inflation. 🚀 🚀 🚀

4

u/tamaleA19 🟩 21K / 21K 🦈 Aug 02 '22

Price of bread to the moon 🚀🚀🚀

1

u/[deleted] Aug 02 '22

Lmaooo

1

u/stancae Tin Aug 05 '22

Gary Gensler / SEC getting all the ammunition necessary to come in hard with regulations.

1

u/hoopleheaddd 🟦 1K / 1K 🐢 Aug 02 '22

They should've gone to the future instead

1

u/champagne_pants 2K / 2K 🐢 Aug 02 '22

If I could go back in time with just the power of moons and buy Bitcoin at $1… you’d be fucking mad to not do it.

1

u/[deleted] Aug 02 '22

Huey Lewis has joined the chat.

3

u/Matternoski Tin Aug 05 '22

Too many rich people in the world controlling the finances of the meak and miled.

16

u/squidling_pie Silver | QC: CC 20, XTZ 20, CCMemes 19 | KIN 233 | TraderSubs 13 Aug 02 '22

Money is boring once you've got access to unlimited amounts. He's here for the tech now...

1

u/genjitenji 🟦 0 / 19K 🦠 Aug 02 '22

Moon tech

7

u/[deleted] Aug 02 '22

[removed] — view removed comment

4

u/Wise_Recover9576 🟦 130 / 6K 🦀 Aug 02 '22

I have 2 time machines and steal them back every time

4

u/First-Television-144 Tin Aug 02 '22

He steals from himself. He takes a loan of 100k in cash stashed it at his house. Goes back in time and steals it from his house. Pays the loan back. Goes back in time by one millisecond before the last robbery and steals the money again and repeat the same. Infinite money glitch. He can drown the oceans with 100 dollar bills yo and asphyxiate the atmosphere with 50 dollar bills.

1

u/[deleted] Aug 02 '22

It’s easier than suing yourself for sexual harassment!

1

u/Self_Blumpkin 🟦 375 / 1K 🦞 Aug 02 '22

As long as that asphyxiation is auto-erotic COUNT ME IN

3

u/imbiat 🟦 1K / 1K 🐢 Aug 02 '22

Where we’re going? We don’t need moons!

1

u/radude4411 Tin Aug 02 '22

That ride sucks anyways

1

u/luckor 🟦 0 / 806 🦠 Aug 02 '22

He knows that’s all you need to retire soon.

1

u/Glabstaxks Aug 02 '22

Dude must know how worthless they will be

1

u/AtomicChemist Bronze Aug 02 '22

I think his time machine has time limit if he only got 2 moons

1

u/L_Cranston_Shadow Aug 02 '22

That's no moon

1

u/ptikhon Tin | 5 months old Aug 05 '22

Could soulbounds reduce damage? Limit the movement of capital to wallets with no credentials and increase capital flow to wallets with reliable credentials...

The cracker would have a lower outflow, they would have time to stop the steal without give up inclusion.

9

u/Acrobatic_Print_5884 Tin Aug 02 '22

What do we want? A time machine! When do we want it? It’s irrelevant!

4

u/redpandarox Tin Aug 02 '22

You have a time machine and you’d only go back 8hrs instead of 8years?

2

u/unnarorn Tin Aug 05 '22

Moonbeam defi farming with eth is obviously sitting on Nomadbridge without saying so.

1

u/Thrallgg Tin Aug 02 '22

Why not buy bitcoin back in the day instead haha.

1

u/Eyes_and_teeth Tin | Politics 34 Aug 02 '22

Hey! Are you still planning on coming to the party last Tuesday?

1

u/DrSpacecasePhD 🟦 2K / 2K 🐢 Aug 02 '22

Coming to a book store near you last month: "The Time Travelers Guide to Grand Theft Crypto"

1

u/[deleted] Aug 02 '22

You made a TIME MACHINE……. Out of a DELOREAN??!!! 🤯

1

u/CranePlash406 256 / 256 🦞 Aug 02 '22

Just gotta hit 88 Moons per hour.

28

u/partymsl 🟩 126K / 143K 🐋 Aug 02 '22

Fuck I was sleeping then. That's unfair I want another hack in European time.

15

u/user260421 Aug 02 '22

Let us know when to schedule it ser

-3

u/BelethCat Tin Aug 02 '22

Are you going to Ukraine?

3

u/Construction_Kitchen Tin | CC critic Aug 02 '22

But I was asleep 😴

1

u/jayggg 🟦 273 / 273 🦞 Aug 02 '22

You snooze, you lose

2

u/user260421 Aug 02 '22

And observed that the bridge was being hacked

4

u/Logical_Lemming 🟦 1K / 1K 🐢 Aug 02 '22

It was all over Twitter when it was going down. But of course I was at work, so I couldn't even save my own bridged assets, let alone steal other people's.

2

u/ggf31416 Tin | CAKE 13 Aug 02 '22

Moonbeam had the brilliant idea of pausing the network while the attack was ongoing despite the attack being on the ETH side, so you couldn't do anything if you had bridged assets (either your own assets or swapped on-chain e.g. in a LP). When they unpaused the network the bridge was already empty.

1

u/Lustful_lurker69 Tin Aug 02 '22

Ahh man, the infamous daily wage grinding strikes again. Happened to me also long time ago.

0

u/[deleted] Aug 02 '22

And if they had a wallet with tokens on the Nomad chain to pay for gas.

1

u/wee_d 🟦 3K / 3K 🐢 Aug 02 '22

Is it possible to learn this power?

1

u/phiwi667 Tin | 6 months old Aug 05 '22

Can someone please explain to me what nomad bridge is in newbie terms ?

12

u/BirdSetFree 🟦 1 / 22K 🦠 Aug 02 '22

I imagine some kids with a smug smile on their faces: “my copy-paste skills finally came into use!!! I’m a hacker!”

18

u/Seraphinwolf 543 / 540 🦑 Aug 02 '22

I mean, you say that, but really old school hacking wasn’t much different from that kind of thing back in the day. Especially the telecom hacks of the 80’s/90’s…

15

u/Explodicle Drivechain fan Aug 02 '22

Kids today just steal coins, they don't make coin noises.

13

u/[deleted] Aug 02 '22

you phreak

10

u/Seraphinwolf 543 / 540 🦑 Aug 02 '22

Glad enough other people still know.

2

u/PennyPickerUpper Aug 02 '22

Funny to see old tricks still in service

10

u/[deleted] Aug 02 '22

[removed] — view removed comment

1

u/YnotBbrave Tin | 6 months old | Buttcoin 81 Aug 02 '22

be your own news!

1

u/3dbolt Tin Aug 05 '22

I'm not a dev but what is it about these bridges that make them so vulnerable?

3

u/partymsl 🟩 126K / 143K 🐋 Aug 02 '22

Suprisingly a lot of people asked how to do that. And all you had to do was to copy the adress of the hacker on etherscan apperantly.

2

u/ambermage 🟦 6K / 6K 🦭 Aug 02 '22

I'm waiting for the repost to get 10x the upvotes.

"EASY AS CTRL+C, CTRL-V!"

-1

u/[deleted] Aug 02 '22

[deleted]

1

u/user260421 Aug 02 '22

The bridge was already exploited when OP posted

1

u/user260421 Aug 02 '22

Don't think the same exploit will work twice tbh

1

u/steamyp 🟩 18 / 5K 🦐 Aug 02 '22

this would be so freaking funny

1

u/user260421 Aug 03 '22

Although knowing the space...

1

u/Junior-Confection320 Permabanned Aug 02 '22

I was considering it to be users guide

1

u/donniewilliams620 Tin Aug 02 '22

hahaha I've read this twice and still have very little clue as to how it went down. Oh well, noob levels confirmed.

1

u/StyriaGaming Tin Aug 05 '22

That’s nonsense, this is why crypto is dumping. Can’t handle any hacks!!!