Receipt 007: Nomad — the same message, replayed fifteen times

# Receipt 007: Nomad — one address in the free-for-all

Executive summary

On 1 August 2022 the Nomad token bridge was drained by a flaw that let the same approval message be replayed by anyone. This receipt traces one address through it, from 22:24:11Z to 23:42:02Z — 77 minutes and 51 seconds, 34 inbound transfers, roughly 51.5 million in tokens.

The replay is visible in the data without any interpretation: the same 202,440.73 USDC arrived fifteen times, from the same contract, over sixteen minutes. Eighteen USDC transfers in total carried only four distinct amounts.

Every stablecoin that arrived left again to the wei: 6,403,276.69 USDC, 450,120.00 FRAX and 7,123,204.23 DAI in, and exactly those amounts out — the USDC and FRAX forwarded to pools *while the drain was still running*. The CQT, FXS and WETH were not forwarded and are still there.

This address is one of many that executed the same replay. This receipt makes no claim about who controlled it, and no claim that it was the first, largest or most culpable participant. It measures what this address did.

This is a retrospective trace of an event that has already happened. It is not a prediction, not a live warning, and not an allegation of legal guilt against any named party.

The receipt

What arrived

Token amounts are not summed into a dollar figure. Pricing six assets at a moment of maximum volatility, on a bridge whose collateral was being removed as the prices were set, would produce a number with more precision than meaning. The units are the measurement.

The replay, in the data

Eighteen USDC transfers, four distinct amounts. A bridge paying out genuine user withdrawals does not pay the same figure fifteen times in sixteen minutes; a replayed message does.

Where it went

The USDC left at 23:33:03Z — nine minutes before the last deposit arrived. The forwarding overlapped the draining.

0xbebc4478…f1c7 is a Vyper contract. We did not take its identity from a label: we called coins(0), coins(1) and coins(2) on it and read back DAI, USDC and USDT, so it is a three-asset stablecoin pool. 0xd632f226…ed3b is also a Vyper contract. 0x649614d3…6fdc has no verified source and we do not label it.

What this receipt establishes

• Between 22:24:11Z and 23:42:02Z on 1 August 2022, this address received 34 token transfers, 18 of them from a single UpgradeBeaconProxy.
• Among them, the identical amount 202,440.73 USDC arrived fifteen times within sixteen minutes.
• Every unit of USDC, FRAX and DAI that arrived left again, matching to the wei; the USDC and FRAX within the hour, the DAI 23 days later.
• 37,514,864.72 CQT, 12,502.96 FXS and 10,203.49 WETH were retained, not forwarded.
• The first stablecoin exit preceded the final inbound transfer by nine minutes.

The token history is complete, not truncated: 50 transfers in total, far below the provider's cap.

A trap this address demonstrates

A naive reading of its token balances would report holdings of 8,200,000 $ staders.com, 98,127 $ USDBonus.net - Visit to claim bonus rewards, 6,000 $ Visit ETHGiftX.com to claim and 1,000 $ TornadoV2.com - TornadoCash new link.

None of these are holdings in any meaningful sense. Addresses associated with a public incident are carpet-bombed with phishing airdrops whose *token names are advertising copy*, sent precisely because the address will be looked at. Any tool that totals ERC-20 balances without filtering unsolicited tokens will report this address as holding millions of dollars of assets that nobody sent it and it never acquired. We exclude them from the table above and list them here instead, which is the only honest way to handle them: not silently dropped, not counted.

What can and cannot be said

Measured by us, from Ethereum: every amount, address, hash, block, timestamp and count in this document, the in/out reconciliation, and the composition of the destination pool (by direct contract call).

Attributed, and marked as attributed: the ~$190M incident figure and the identification of this address as a Nomad participant both come from our own exploit_attributions record, which carries confidence reported and states "public incident reporting; not an OFAC designation". We have not independently verified either, and this address does not appear on our copy of the OFAC SDN list.

Inferred, and labelled as inference: that fifteen identical transfers indicate a replayed message rather than fifteen coincidental equal withdrawals. The chain shows the repetition; the mechanism is our reading of it.

Not established at all: who controlled this address; whether it acted first, or took the most; what happened to the CQT, FXS and WETH after this window; and the identity of the address that received the DAI.

Explicitly not claimed: that this address is *the* Nomad exploiter. The defining feature of this incident is that the same call was available to everyone, and many addresses used it. This is one of them.

Method and limitations

Read from the Etherscan V2 API on Ethereum mainnet (chainid=1) via tokentx, plus eth_call against the destination pool to read its coins(). Amounts are raw values normalised by each token's decimals. The drain window is defined as 2022-08-01 to 2022-08-03 inclusive; every inbound transfer in it fell on 1 August.

This receipt covers one address. It is not a reconstruction of the Nomad incident, does not total the incident's losses, and does not enumerate the other participants.

The analysis is retrospective and incomplete by design. It does not identify a natural person, prove intent, cover every downstream hop, or constitute legal, investment, or sanctions advice. It makes no claim that Scienter predicted this event.

Screenshot policy

Scienter's /ledger/[hash] page accepts Scienter call hashes; it is not a general transaction renderer. We did not manufacture dashboard screenshots for foreign hashes the route cannot resolve. The explorer permalinks above are the canonical visual receipts.

Source index

• Subject address on Etherscan — every transfer cited above
• Source contract on Etherscan — the UpgradeBeaconProxy that sent 18 of the 34
• Scienter exploit_attributions record — the incident figure and the address attribution, confidence reported, explicitly not an OFAC designation