Bridge · Review
Nomad Review 2026: Optimistic Bridge Hit by the 2022 Exploit
Nomad is an optimistic cross-chain messaging protocol and token bridge best known for a roughly $200M exploit in August 2022. Today it holds very little value, and the main takeaway is caution.
By the DappsAtlas editorial team · Updated
DappsAtlas score
3.0/10
Weak
Our verdict on Nomad
3.0/10Nomad has an interesting optimistic design for cross-chain messaging, and developers may still find the docs and SDK worth reading. As a place to move funds, it is hard to recommend. The August 2022 exploit of almost $200M, no listed audits, a tiny TVL and a site that looks unmaintained all point to high risk. Use it, if at all, only after confirming its current status in the docs, and only with amounts you can afford to lose.
Score breakdown
How Nomad scores
- Security
- 2.0/10
- Ease of use
- 5.0/10
- Fees
- n/a
- Features
- 5.0/10
Scores run from 0 to 10 and are based only on facts we could verify. Where information was missing we mark the score n/a rather than guess.
What is Nomad?
Nomad is a cross-chain messaging protocol with a token bridge on top. It describes itself as security-first and uses an optimistic design, where watchers can challenge messages with fraud proofs instead of relying on validators. DefiLlama categorizes it as a bridge and has tracked it since April 2022.
It is best known for what happened in August 2022. Reports from that time say the team updated a smart contract in a way that made it easy to spoof transactions, and attackers drained almost $200M. The homepage still carries a banner asking white-hat hackers to return ETH or ERC-20 tokens to a listed wallet, and the docs include a funds recovery section.
Today DefiLlama shows about $304,751 in TVL across Ethereum, Moonbeam, Milkomeda and Evmos, up 5.3% over seven days. The homepage footer reads 2022 and includes placeholder text, so it does not look actively maintained. This review treats the current status as unclear.
How Nomad works
Nomad is deployed as smart contracts on two chains, with a lightweight off-chain component. There is no separate blockchain and no validator set. A message sent on one chain is posted with a commitment that the destination chain accepts after a waiting period.
During that period, off-chain watchers can submit a fraud proof to challenge an invalid message. This is the optimistic part: messages are assumed valid unless someone proves otherwise, so Nomad says only one honest watcher is needed to protect the system.
On top of messaging sits a token bridge. A user locks or burns a token on the source chain, a message is relayed, and the matching token is released or minted on the destination chain. Developers can use the same channels to send arbitrary data or trigger contract calls across chains.
5 features
Key features
01
Optimistic security model
Off-chain watchers can challenge messages with fraud proofs, so the system needs only one honest actor to stay safe. It does not depend on validators or custodians.
02
Generalized message passing
Developers can pass arbitrary data between chains and even invoke smart contract functions on another chain, using the Nomad SDK.
03
ERC-20 token bridge
Users can bridge ERC-20 tokens across EVM chains. The homepage says the bridge is powered by Nomad and Connext.
04
Lower gas overhead
The homepage claims gas costs roughly 10x lower than traditional header relay systems.
05
Extensible deployment
Contracts are described as deployable on any smart contract chain without custom logic, and the project points to xApp code examples.
Pros and cons
What we like
- Clear design idea: an optimistic model that needs only one honest watcher and no validator set.
- Generalized message passing lets developers send data and call contracts across chains, not just move tokens.
- Open SDK and documentation, with xApp example code.
- Docs include a funds recovery section and the site publicly asks for return of exploited funds.
- Claims about 10x lower gas than header relay systems, though no figure is given for actual transfers.
Watch out for
- Suffered a nine-figure exploit in August 2022, reported as almost $200M drained, after a smart contract update let users spoof transactions.
- Current TVL is only about $304,751, a tiny fraction of what a major bridge would hold, so liquidity and activity look limited.
- DefiLlama lists no audits for the project.
- The homepage still shows a 2022 copyright and a white-hat bounty banner asking for returned funds, which suggests little recent activity.
- Agent (watcher and relayer) operations were run by the core team at the time of the docs entry, which is a centralization point.
- Cross-chain bridges as a class carry smart-contract risk, and a single bug can affect all funds locked in the system.
Nomad fees
Nomad does not publish a fee schedule. The homepage claims gas costs about 10x lower than traditional header relay systems, but gives no specific bridging fee.
Users would see the actual cost, including network gas on both chains, in the bridge interface before confirming a transfer. Check the docs for any protocol or relayer fees.
Is Nomad safe?
Nomad's security record is the central issue. In August 2022 the bridge was exploited for almost $200M after a contract update made it easy to spoof transactions. DefiLlama lists no audits for the project. The docs entry said agents were operated by the core team, which adds a trust assumption despite the decentralized framing.
Public sources give no information on the current team, insurance or regulatory status. As with any bridge, funds held in smart contracts can be lost to bugs, and bridged tokens depend on the health of the bridge. Treat any interaction as high risk and do your own checks.
6 steps
How to get started with Nomad
- 1
Read the official docs first, especially the security and funds recovery sections, to understand the project's current state.
- 2
Confirm independently that the bridge is operating and which chains and tokens are supported right now.
- 3
Use a wallet you control and check you are on the correct official site, not a copycat.
- 4
If you proceed, test with a very small amount of an ERC-20 token between supported chains.
- 5
Review the fee and gas estimates shown before confirming, and keep transaction records.
- 6
Do not leave large sums in bridged assets, given the history of this protocol.
Who Nomad is for
Mainly developers and researchers interested in optimistic cross-chain messaging and the lessons of the 2022 exploit. It is not well suited to users who want a well-audited, actively used bridge for significant amounts.
Nomad FAQs
What is Nomad?
Nomad is a cross-chain messaging protocol and token bridge. It moves tokens and arbitrary data between blockchains using an optimistic mechanism instead of a validator set.
What happened in the Nomad bridge hack?
In August 2022 hackers abused a flaw introduced by a smart contract update that made it easy to spoof transactions. Press coverage at the time reported almost $200M drained. The homepage still carries a banner asking white-hat hackers to return funds.
Is Nomad still active?
The project does not show that it shut down. The site still lists a bridge launch link, but the copyright reads 2022 and DefiLlama shows TVL of about $304,751, so its present activity and support are unclear. Check the official docs for current status before interacting.
Which chains does Nomad support?
DefiLlama lists Ethereum, Moonbeam, Milkomeda and Evmos. Nomad's contracts are described as deployable on any smart contract chain, but only these are listed in the data.
Does Nomad have a token?
No. DefiLlama lists no token for Nomad.
Is the Nomad bridge safe to use?
Given the 2022 exploit, the absence of listed audits and the low TVL, the risk is high. Anyone considering it should read the docs on funds recovery and security and use only amounts they can afford to lose.
Compare
Nomad alternatives
LayerZero V2 is a cross-chain messaging protocol and bridge infrastructure for developers and asset issuers, connecting dozens of blockchains.
Chainlink CCIP is a cross-chain messaging and token-transfer protocol for developers, token issuers and institutions, with about $1.89B TVL on 21 chains.
Unit is the asset tokenization layer on Hyperliquid, letting users deposit and withdraw native assets like BTC, ETH and SOL.
USDT0 is Tether's omnichain system that puts USDT and tokenized gold (XAUT0) on 25+ blockchains, for users and protocols needing unified stablecoin liquidity.
cBridge is Celer Network's multi-chain bridge for moving tokens across Ethereum, layer-2s and sidechains, for DeFi users who bridge between many networks.
Aster Bridge is the multichain deposit layer of Aster, a perpetuals DEX backed by YZi Labs, for traders funding one account from several chains.
Same category
More Bridges
Hyperliquid Bridge moves USDC from Arbitrum onto the Hyperliquid Layer 1 for traders using its perpetual and spot markets.
Lombard BTC.b is a 1:1 Bitcoin representation for moving BTC across several chains in DeFi, secured by a validator consortium and redeemable for native BTC.
Wan Bridge is Wanchain's cross-chain bridge, linking over 30 networks including Bitcoin, XRPL, Ethereum and Solana, for users moving assets across chains.
sBTC is a SIP-010 token on Stacks pegged 1:1 to Bitcoin, for BTC holders who want to use their Bitcoin in DeFi and smart contracts.
FAssets is an over-collateralized bridge on Flare that lets XRP, BTC and DOGE holders mint wrapped tokens to use in DeFi.
BOB is a Bitcoin-focused EVM hybrid L2 with a Gateway for native BTC swaps, bridging and DeFi, aimed at Bitcoin holders and developers.
Same chain
More on Ethereum
Lido is a liquid staking protocol where users stake ETH and receive stETH, a reward-earning token usable across DeFi, governed by LDO holders.
Aave V3 is a non-custodial DeFi lending protocol on 21 chains where users earn interest on deposits or borrow against collateral.
Uniswap V4 is the latest Uniswap DEX version with hooks and concentrated liquidity, running on 22 chains for self-custody token swaps and liquidity provision.
Uniswap V3 is a non-custodial decentralized exchange protocol for token swaps and concentrated liquidity provision across 40+ chains.
DeFi Saver is a non-custodial tool for managing and automating leveraged lending positions across major DeFi protocols on Ethereum and layer-2 networks.
OKX is a major centralized crypto exchange for spot and derivatives trading, earn products and a Web3 wallet, with its own OKB token.
Guides
Guides about Nomad
Security and scams
Nomad Bridge Hack: How the 2022 Exploit Became Decentralized LootingIn August 2022 a flaw in the Nomad token bridge let copycat attackers drain funds in a public free-for-all, and it remains a standard case study in bridge security. This guide explains what went wrong, why the losses spread so fast, and what users and builders can take from it today.
Security and scams
Why Cross-Chain Bridges Became the Top Target for Crypto HackersCross-chain bridges hold large pools of locked tokens and run complex verification logic, which makes them one of the most attractive targets in crypto. This guide explains why they attract attackers, how the main failure points work, and what users can check before moving funds.
How we checked
Sources
Last updated . Spotted an error? Tell us and we will correct it.