Loading story…
The Federal Trade Commission (FTC) has reached a settlement with Illusory Systems, operating as Nomad, following a 2022 cyberattack that exploited a vulnerability in the company's Token Bridge cryptocurrency bridge. The attack resulted in the theft of approximately $186 million in digital assets, with customers ultimately losing around $100 million after partial recoveries. The FTC alleged that Nomad misrepresented the security of its product and introduced inadequately tested code that led to the breach. As part of the immediate response, Nomad launched a white hat bounty program, offering legal amnesty and a 10% reward to attackers who returned at least 90% of the stolen funds.
Under the proposed FTC settlement, Nomad is required to repay about $37.5 million to affected users, implement a comprehensive security program, and undergo regular third-party security assessments. The company is also barred from making further misrepresentations about its product security. The FTC emphasized the importance of companies upholding their cybersecurity promises and taking reasonable measures to protect consumers from theft and fraud, highlighting the regulatory consequences of failing to secure blockchain infrastructure.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
In December 2025, the FTC announced a proposed order against Illusory Systems requiring it to distribute about $37.5 million in recovered funds to affected users, stop misrepresenting its security, implement a comprehensive cybersecurity program, and undergo independent third-party assessments. The proposed settlement was opened for a 30-day public comment period before final approval.
Following the hack, the FTC concluded that Illusory Systems misrepresented Nomad's security and failed to implement reasonable safeguards, including secure coding, vulnerability management, staffing, testing, and incident response. The agency also said the company ignored internal and external security warnings.
After the breach, Nomad offered legal amnesty and a 10% reward to parties who returned at least 90% of stolen assets. The effort helped recover some funds, though roughly $100 million remained unrecovered.
In 2022, threat actors exploited the vulnerability in Nomad's cryptocurrency bridge, leading to the theft of about $186 million in user funds. The breach became one of the major crypto theft incidents tied to a smart contract security failure.
In June 2022, Illusory Systems introduced a significant vulnerability into Nomad's Token Bridge smart contract through inadequately tested code. The FTC later alleged the company lacked secure coding practices and adequate testing controls when the flaw was added.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
4 references tracked. Mallory keeps watching after this page renders.
databreaches.net
Open sourcego.theregister.com
Open sourcetherecord.media
Open sourcecyberscoop.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Roger Ver, a prominent early bitcoin investor known as "Bitcoin Jesus," agreed to pay nearly $50 million to the U.S. Department of Justice to settle federal tax charges related to his cryptocurrency holdings. Ver entered into a deferred prosecution agreement after admitting that he willfully omitted a significant portion of his bitcoin assets when filing expatriation-related tax returns in 2016, which reduced his tax liability by over $16.8 million. The settlement included back taxes, penalties, and interest, and following the payment, prosecutors moved to dismiss the indictment against him. This case highlights the increasing scrutiny by U.S. authorities on cryptocurrency investors who attempt to evade taxes by renouncing citizenship or failing to report digital assets. In a separate incident, a trader suffered a loss of approximately $21 million on the decentralized exchange Hyperliquid due to a private key compromise. The attacker was able to access the trader's wallet and transfer the funds, underscoring the persistent risks associated with private key management in decentralized finance (DeFi) platforms. The Hyperliquid incident demonstrates the ongoing threat of targeted attacks against high-value cryptocurrency accounts, where a single compromised key can result in substantial financial losses. Additionally, the Ethereum Foundation and Keyring launched a fund to support the legal defense of Tornado Cash developers, reflecting the broader legal and regulatory challenges facing the crypto ecosystem. Indian authorities initiated an investigation into Binance traders for alleged crypto tax evasion, signaling a global trend of increased regulatory enforcement in the digital asset space. Hackers executed a $32.5 million dump, marking the largest crypto liquidation event of the week, which had significant market impact and raised concerns about the security of large-scale digital asset holdings. New York City established the nation's first mayoral office dedicated to digital assets and blockchain, indicating growing institutional interest in the sector. These incidents collectively illustrate the multifaceted risks in the cryptocurrency landscape, including legal, regulatory, and technical threats. The convergence of high-profile tax settlements, major thefts, and regulatory actions highlights the need for robust compliance and security measures among digital asset holders and service providers. The events also emphasize the importance of secure key management practices and the potential consequences of lapses in operational security. As the digital asset market matures, both individual investors and organizations must remain vigilant against evolving threats and regulatory developments. The week's developments serve as a reminder that the intersection of technology, finance, and law in the crypto space is increasingly complex and fraught with risk. Ongoing education, proactive risk management, and engagement with legal and regulatory frameworks are essential for mitigating exposure in this rapidly changing environment.
Jul 12, 2026
Polymarket said attackers stole funds from an undisclosed number of users after compromising a third-party vendor and injecting malicious code into the company's website. The platform said the incident has been contained, affected customers are being notified, and victims will be fully reimbursed. A company spokesperson confirmed the theft but did not disclose how many users were impacted. Independent blockchain researchers described the activity as a phishing-style campaign that drained more than 11 Polymarket wallets holding **PUSD**, with estimated losses of about **$2.94 million to $3 million**. Researchers also reported that the attacker moved the stolen assets from **Polygon** to **Ethereum** and converted them into roughly **1,893 ETH**, indicating a rapid effort to launder the proceeds after the website compromise.
Jun 29, 2026
A Singapore court has allowed **Zettai Pte Ltd**, the parent entity tied to crypto exchange **WazirX**, to hold an online creditors’ meeting on a restructuring plan aimed at recovering more than **$230 million** stolen in a July 2024 cyberattack. The High Court also granted a **16-week moratorium** and approved changes to streamline the voting process, while saying there was no proper evidence for claims that Zettai had orchestrated the theft. WazirX said the proposed scheme would reorganize liabilities, issue recovery tokens, and potentially restart the platform with new products including a decentralized exchange; if creditors and the court approve it, initial payouts could begin within 10 business days after the plan takes effect. The recovery effort follows a July 18 breach of a **multi-signature wallet** that forced WazirX to halt rupee and crypto withdrawals and later revealed losses affecting roughly **45% of exchange assets**. WazirX and custody provider **Liminal** publicly disputed responsibility for the exploit, while users criticized the exchange’s transparency, withdrawal freezes, and an earlier **"socialised loss"** proposal that would have returned only 55% of tokens immediately. The company has reported the incident to police, launched bounty efforts, said it had frozen an initial **$3 million** tranche of stolen assets, and disclosed liquid assets of **566.38 million USDT** against **546.47 million USDT** in claims as legal and customer pressure continues to mount.
Jun 29, 2026