Israel Extradites Alleged Nomad Exploit Suspect in $2.8M Theft

By Nathan Brooks

Israel extradited Alexander Block, formerly Alexander Gurevich, to the United States on Thursday to face charges over an alleged $2.8 million theft from crypto bridge Nomad, according to Israel’s State Attorney’s Office.

Block was transferred to U.S. authorities early Thursday after unsuccessful appeals in Israel, according to The Jerusalem Post. The Israeli-Russian citizen was arrested at Ben Gurion Airport in May 2025 while preparing to fly to Russia, shortly after changing his surname and obtaining a passport in his new name.

A federal grand jury in the Northern District of California indicted Block in August 2023 on four counts of computer fraud, one count of transporting stolen property and three counts of money laundering, according to the Israeli Supreme Court’s judgment. The United States requested his extradition in December 2024.

According to the U.S. extradition request reproduced in the judgment, a June 2022 software update left a flaw in Nomad’s smart contracts. The flaw allowed users to receive tokens on one blockchain without locking the equivalent assets on another.

Block, operating under the username “Bitlik,” allegedly conducted six test transfers before making four main transfers around August 1, 2022. He received tokens worth more than $2.8 million, then moved them through several wallets and converted them into other cryptocurrencies to conceal their origin.

His actions exposed the flaw to other Nomad users, who drained a Nomad-controlled wallet holding more than $186 million in user funds, according to prosecutors. The broader loss was more than an order of magnitude larger than his alleged $2.8 million haul. The August 2022 attack drained nearly all of Nomad’s funds.

A few days after the transfers, Block returned some tokens and contacted a senior Nomad official on Telegram. He offered to return the remainder in exchange for payment for finding the flaw, then cut off contact. Nomad referred the matter to U.S. law enforcement.

The Jerusalem District Court approved Block’s extradition in July 2025. On appeal, Block argued that the transactions used functions available within Nomad’s automated system and that the public record of blockchain transfers undermined the money laundering allegations.

Israel’s Supreme Court rejected both arguments. It held that exploiting a programming flaw could constitute unlawful computer intrusion even when software technically permitted the action. The court also found that publicly visible transactions do not necessarily identify the people behind wallets or exclude efforts to conceal where funds came from.

Supreme Court President Isaac Amit later denied Block’s request for a further hearing, according to the State Attorney’s Office. Paradigm researcher Sam Sun, in remarks reported by Decrypt at the time, described the copycat losses as “a frenzied free-for-all,” noting that little technical knowledge was required to reproduce the original attack.

In December 2025, the Federal Trade Commission proposed a settlement with Illusory Systems, Nomad’s operator, saying the bridge lost $186 million after hackers exploited a poorly tested software update. The proposal would require Illusory Systems to return recovered funds to users who had not been reimbursed. Nomad recovered about $22 million in the days after the hack.

What does the extradition change for users and bridge operators?

For users, the practical change is jurisdictional rather than immediate restitution. Block now faces a U.S. federal case over the $2.8 million prosecutors say he took. The FTC proposal separately addresses broader recovery, while Israel’s ruling gives U.S. prosecutors a reference point: permission to execute code does not automatically settle whether conduct constitutes intrusion.

For bridge operators, the operational consequence is direct. The FTC described the update as poorly tested, and Israel’s top court rejected the argument that an automated system’s available functions automatically make exploitation lawful. Those enforcement actions put update testing, transaction tracing and the boundary between technical access and unauthorized conduct at the center of scrutiny.

The next enforcement window is the FTC’s proposed settlement and Block’s U.S. case. The FTC terms remain a proposal, and no trial date was announced. As those proceedings continue, bridge operators should expect scrutiny to focus on software testing and user authorization, even when smart contracts technically accepted a transfer.