Israel has extradited an Israeli-Russian national to the United States to face charges over the alleged theft of roughly $2.8 million from the cross-chain bridge Nomad, Israel's State Attorney's Office announced on Thursday, according to a report by The Jerusalem Post.

Alexander Block, previously known as Alexander Gurevich, was handed over to U.S. authorities early Thursday after unsuccessful appeals in Israel. He was arrested at Ben Gurion Airport in May 2025 as he prepared to board a flight to Russia, shortly after changing his surname and obtaining a passport under his new name. The handover came more than three years after the exploit itself.

Prosecutors allege that Block's exploit exposed a vulnerability that other users then used to drain more than $186 million from a Nomad-controlled wallet. Bridges like Nomad hold pools of user assets to move tokens between blockchains, and their concentrated stores of funds have made them targets in several of crypto's largest thefts.

Indictment and Extradition Request

A federal grand jury in the Northern District of California indicted Block in August 2023 on four counts of computer fraud, one count of transporting stolen property and three counts of money laundering, according to Israel's Supreme Court judgment in the case. The United States formally requested his extradition in December 2024.

According to the U.S. extradition request, as set out in the judgment, a June 2022 software update left a flaw in Nomad's smart contracts that allowed users to receive tokens on one blockchain without locking up the equivalent assets on another. Bridges depend on that one-to-one lockup to keep the tokens issued on each chain fully backed, which is why a flaw that broke the linkage left user deposits exposed. Block, allegedly operating under the username "Bitlik," is said to have made six test transfers before executing four main transfers around August 1, 2022, receiving tokens worth more than $2.8 million. He then allegedly moved the tokens through a series of wallets and converted them into other cryptocurrencies to conceal their origin.

The extradition request alleges that Block's actions revealed the flaw to other Nomad users, who went on to drain a Nomad-controlled wallet holding more than $186 million in user funds. A few days later, Block returned some of the tokens and contacted a senior Nomad official on Telegram, offering to hand back the remainder in exchange for payment for identifying the flaw. He subsequently cut off contact, and Nomad turned to U.S. law enforcement.

Supreme Court Rejects Appeal

The Jerusalem District Court approved Block's extradition in July 2025. On appeal, he argued that his transactions merely used functions available within Nomad's automated system, and that the public record of blockchain transfers undermined the money laundering allegations.

Israel's Supreme Court rejected both arguments. It held that exploiting a programming flaw can constitute unlawful computer intrusion even where the software technically permits the action, The Jerusalem Post reported. The court also found that publicly visible transactions do not necessarily identify the people behind the wallets, nor do they rule out efforts to conceal the origin of funds. The ruling speaks to a question that recurs whenever automated crypto systems are exploited: whether conduct a program technically permits can still be criminal.

Supreme Court President Isaac Amit later rejected Block's request for a further hearing, according to the State Attorney's Office.

Aftermath of the August 2022 Exploit

The August 2022 incident drained Nomad of nearly all of its funds. Because replicating the original attack required little technical skill, Paradigm researcher Sam Sun likened what followed to "a frenzied free-for-all," as Decrypt reported at the time.

In December 2025, the U.S. Federal Trade Commission proposed a settlement with Illusory Systems, Nomad's operator, stating that the bridge lost $186 million after hackers exploited a poorly tested software update. Under the proposed settlement, the company would be required to return recovered funds to users who have not yet been reimbursed. Nomad recovered approximately $22 million in the days following the hack. With the FTC settlement still only a proposal and Block's U.S. prosecution now set to proceed, the reimbursement process and the criminal case in the Northern District of California remain the developments to watch.